Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541690
MD5:	ae1078e39c36c64162fa9537c6626fda
SHA1:	670b5241741e03878bef70ca298e339bd221bf13
SHA256:	c5a8e24da16df065a785c3545b812009e8896b54561308e1eb0bb93fe517e851
Tags:	exeuser-Bitsight
Infos:

Detection

Credential Flusher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AE1078E39C36C64162FA9537C6626FDA)

taskkill.exe (PID: 7420 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7512 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7576 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7636 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7700 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7764 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7796 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7812 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8056 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2f53fb4-f41f-4ad4-bf60-a7c4f431874e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a2ee06d310 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7564 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4200 -parentBuildID 20230927232528 -prefsHandle 3916 -prefMapHandle 3872 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25cb7036-35d6-4930-967d-0ea6458a771e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a3003be110 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4248 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5500 -prefMapHandle 5524 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd47ad4d-ee96-47ae-be13-5a28d62fa25a} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a309888b10 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1808662177.00000000009B0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000000.00000003.1808732984.00000000009B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: file.exe PID: 7400	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Code function: 0_2_00F4EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00F4EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F4ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00F4EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F3AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00F3AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F69576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00F69576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_50fb0d47-5
Source: file.exe, 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1fb03fd3-1
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_541e3ed6-7
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fc1382ea-6

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000023F47DE7D77 NtQuerySystemInformation,		16_2_0000023F47DE7D77
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000023F484A27B2 NtQuerySystemInformation,		16_2_0000023F484A27B2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F3D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00F3D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F31201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00F31201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F3E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00F3E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED8060	0_2_00ED8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F42046	0_2_00F42046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F38298	0_2_00F38298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0E4FF	0_2_00F0E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0676B	0_2_00F0676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F64873	0_2_00F64873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDCAF0	0_2_00EDCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFCAA0	0_2_00EFCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EECC39	0_2_00EECC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F06DD9	0_2_00F06DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED91C0	0_2_00ED91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEB119	0_2_00EEB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF1394	0_2_00EF1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF1706	0_2_00EF1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF781B	0_2_00EF781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF19B0	0_2_00EF19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE997D	0_2_00EE997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED7920	0_2_00ED7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF7A4A	0_2_00EF7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF7CA7	0_2_00EF7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF1C77	0_2_00EF1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F09EEE	0_2_00F09EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5BE44	0_2_00F5BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF1F32	0_2_00EF1F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000023F47DE7D77	16_2_0000023F47DE7D77
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000023F484A27B2	16_2_0000023F484A27B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000023F484A2EDC	16_2_0000023F484A2EDC
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 16_2_0000023F484A27F2	16_2_0000023F484A27F2

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00EEF9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00EF0A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.troj.evad.winEXE@34/34@67/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F437B5 GetLastError,FormatMessageW,

0_2_00F437B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F310BF AdjustTokenPrivileges,CloseHandle,		0_2_00F310BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00F316C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00F451CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F3D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00F3D4DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00F4648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00ED42A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000D.00000003.1882065633.000001A3098AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2f53fb4-f41f-4ad4-bf60-a7c4f431874e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a2ee06d310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4200 -parentBuildID 20230927232528 -prefsHandle 3916 -prefMapHandle 3872 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25cb7036-35d6-4930-967d-0ea6458a771e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a3003be110 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5500 -prefMapHandle 5524 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd47ad4d-ee96-47ae-be13-5a28d62fa25a} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a309888b10 utility
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2f53fb4-f41f-4ad4-bf60-a7c4f431874e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a2ee06d310 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4200 -parentBuildID 20230927232528 -prefsHandle 3916 -prefMapHandle 3872 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25cb7036-35d6-4930-967d-0ea6458a771e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a3003be110 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5500 -prefMapHandle 5524 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd47ad4d-ee96-47ae-be13-5a28d62fa25a} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a309888b10 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000D.00000003.1957523914.000001A307948000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdbGCTL source: firefox.exe, 0000000D.00000003.1960399622.000001A3021D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdb source: firefox.exe, 0000000D.00000003.1960399622.000001A3021D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 0000000D.00000003.1960399622.000001A3021D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 0000000D.00000003.1957523914.000001A30797E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000D.00000003.1949969680.000001A2FD702000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.13.dr
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000D.00000003.1960399622.000001A3021D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000D.00000003.1949969680.000001A2FD702000.00000004.00000020.00020000.00000000.sdmp

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00ED42DE

Source: gmpopenh264.dll.tmp.13.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF0A76 push ecx; ret

0_2_00EF0A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00EEF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F61C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00F61C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95913

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 16_2_0000023F47DE7D77 rdtsc

16_2_0000023F47DE7D77

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.6 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F3DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F468EE FindFirstFileW,FindClose,	0_2_00F468EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00F4698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F3D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F3D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F49642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F49642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F4979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F49B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00F49B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F45C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00F45C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00ED42DE

Source: firefox.exe, 0000000F.00000002.3021632730.00000187A3C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: firefox.exe, 00000011.00000002.3020291366.0000024DE4000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-
Source: firefox.exe, 00000010.00000002.3021512498.0000023F48290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: firefox.exe, 0000000F.00000002.3014884533.00000187A376A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3012818467.0000023F4799A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3021512498.0000023F48290000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3013519931.0000024DE3BBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000000F.00000002.3020516110.00000187A3B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000000F.00000002.3021632730.00000187A3C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: firefox.exe, 0000000F.00000002.3021632730.00000187A3C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"
Source: firefox.exe, 0000000F.00000002.3021632730.00000187A3C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb
Source: firefox.exe, 0000000F.00000002.3021632730.00000187A3C00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3021512498.0000023F48290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 16_2_0000023F47DE7D77 rdtsc

16_2_0000023F47DE7D77

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4EAA2 BlockInput,

0_2_00F4EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F02622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F02622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00ED42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00EF4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F30B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00F30B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F02622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F02622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00EF083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF09D5 SetUnhandledExceptionFilter,	0_2_00EF09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00EF0C21

Source: C:\Users\user\Desktop\file.exe

0_2_00F31201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F12BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F12BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F3B226 SendInput,keybd_event,

0_2_00F3B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00F522DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00F30B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F31663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F31663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF0698 cpuid

0_2_00EF0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F48195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00F48195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F2D27A GetUserNameW,

0_2_00F2D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F0BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F0BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00ED42DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match	File source: 00000000.00000003.1808662177.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1808732984.00000000009B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: 00000000.00000003.1808662177.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1808732984.00000000009B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7400, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F51204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00F51204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F51806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00F51806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
file.exe	41%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
http://detectportal.firefox.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://datastudio.google.com/embed/reporting/	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://shavar.services.mozilla.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	0%	URL Reputation	safe
https://identity.mozilla.com/ids/ecosystem_telemetryU	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	0%	URL Reputation	safe
https://monitor.firefox.com/breach-details/	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	0%	URL Reputation	safe
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	0%	URL Reputation	safe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	0%	URL Reputation	safe
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://shavar.services.mozilla.com/	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://monitor.firefox.com/user/dashboard	0%	URL Reputation	safe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://coverage.mozilla.org	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://blocked.cdn.mozilla.net/	0%	URL Reputation	safe
https://json-schema.org/draft/2019-09/schema	0%	URL Reputation	safe
https://profiler.firefox.com	0%	URL Reputation	safe
https://outlook.live.com/default.aspx?rru=compose&to=%s	0%	URL Reputation	safe
https://identity.mozilla.com/apps/relay	0%	URL Reputation	safe
https://mozilla.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
https://poczta.interia.pl/mh/?mailto=%s	0%	URL Reputation	safe
https://watch.sling.com/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
twitter.com	104.244.42.129	true	false	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	unknown
services.addons.mozilla.org	151.101.129.91	true	false	unknown
dyna.wikimedia.org	185.15.59.224	true	false	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	unknown
contile.services.mozilla.com	34.117.188.166	true	false	unknown
youtube.com	172.217.18.14	true	false	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	unknown
youtube-ui.l.google.com	142.250.181.238	true	false	unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	unknown
reddit.map.fastly.net	151.101.129.140	true	false	unknown
ipv4only.arpa	192.0.0.171	true	false	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	unknown
push.services.mozilla.com	34.107.243.93	true	false	unknown
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	unknown
www.reddit.com	unknown	unknown	false	unknown
spocs.getpocket.com	unknown	unknown	false	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false	unknown
support.mozilla.org	unknown	unknown	false	unknown
firefox.settings.services.mozilla.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	unknown
detectportal.firefox.com	unknown	unknown	false	unknown
normandy.cdn.mozilla.net	unknown	unknown	false	unknown
shavar.services.mozilla.com	unknown	unknown	false	unknown
www.wikipedia.org	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000010.00000002.3017064904.0000023F47EC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3016737730.0000024DE3FC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://detectportal.firefox.com/	firefox.exe, 0000000D.00000003.1994454143.000001A2FFBAA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000D.00000003.1882065633.000001A3098AF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com0	gmpopenh264.dll.tmp.13.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	firefox.exe, 0000000F.00000002.3016514348.00000187A39CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3017064904.0000023F47EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3020658723.0000024DE4103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000D.00000003.1830912151.000001A305E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1923472982.000001A305E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830166918.000001A305E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830296644.000001A305E66000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000011.00000002.3016737730.0000024DE3F8E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000000D.00000003.1884275730.000001A3019D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000000D.00000003.1889404825.000001A2FFDCD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://shavar.services.mozilla.com	firefox.exe, 0000000D.00000003.1889404825.000001A2FFDCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1991797721.000001A2FFDE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1993939547.000001A2FFDE8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000D.00000003.1792707501.000001A2FDC3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1792130968.000001A2FDC1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1793105046.000001A2FDC5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1791839721.000001A2FDA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1795433552.000001A2FDC77000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000000D.00000003.1954248828.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1962509595.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1980926934.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1895277700.000001A30A2C3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/breach-details/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 0000000D.00000003.1884160502.000001A305F13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1831881787.000001A2FED67000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000D.00000003.1792707501.000001A2FDC3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1792130968.000001A2FDC1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1793105046.000001A2FDC5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1791839721.000001A2FDA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1795433552.000001A2FDC77000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.msn.com	firefox.exe, 0000000D.00000003.1884429400.000001A301452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964492796.000001A301452000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000D.00000003.1792707501.000001A2FDC3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1792130968.000001A2FDC1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1793105046.000001A2FDC5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1791839721.000001A2FDA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1795433552.000001A2FDC77000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.com/	firefox.exe, 0000000D.00000003.1965834808.000001A300263000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1829744373.000001A3004A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1889067218.000001A300263000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1888001185.000001A3004A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	firefox.exe, 0000000F.00000002.3016514348.00000187A39CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3017064904.0000023F47EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3020658723.0000024DE4103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false		unknown
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000000D.00000003.1993107779.000001A30A23B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.instagram.com/	firefox.exe, 0000000D.00000003.1841392170.000001A300752000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1846091284.000001A300752000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.accounts.firefox.com/v1	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/	firefox.exe, 0000000D.00000003.1956475110.000001A30984F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	firefox.exe, 0000000D.00000003.1889404825.000001A2FFDCD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	firefox.exe, 0000000F.00000002.3016514348.00000187A39CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3017064904.0000023F47EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3020658723.0000024DE4103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false		unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000000D.00000003.1801533892.000001A2FBADA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1929414630.000001A2FBAD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1942071309.000001A2FBADE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 0000000D.00000003.1876994853.000001A2FEA75000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000010.00000002.3017064904.0000023F47EC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3016737730.0000024DE3FC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 0000000D.00000003.1876994853.000001A2FEA75000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000D.00000003.1971672402.000001A2FFA85000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 0000000D.00000003.1882065633.000001A3098AF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.com/account?=	recovery.jsonlz4.tmp.13.dr	false		unknown
https://shavar.services.mozilla.com/	firefox.exe, 0000000D.00000003.1977443990.000001A306748000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 0000000D.00000003.1884275730.000001A3019D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3017064904.0000023F47E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3016737730.0000024DE3F13000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000000D.00000003.1884160502.000001A305F13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1831881787.000001A2FED67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/dashboard	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000D.00000003.1802702293.000001A2FE1D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1884160502.000001A305F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1986420285.000001A2FE1D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1986286876.000001A2FE1DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1828346815.000001A305FA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830669097.000001A305E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800379329.000001A2FEC13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1928113516.000001A2FF494000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1906551518.000001A2FF9CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1800521720.000001A2FEC12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1828346815.000001A305FD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1919094392.000001A2FFA7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830296644.000001A305E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1908871657.000001A2FFCE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1907971661.000001A2FFC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990604345.000001A305F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1889067218.000001A300263000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830669097.000001A305E50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1828492091.000001A305F61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1919094392.000001A2FFA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964145321.000001A306032000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://account.bellmedia.c	firefox.exe, 0000000D.00000003.1884429400.000001A301452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964492796.000001A301452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://youtube.com/	firefox.exe, 0000000D.00000003.1883402470.000001A305FE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com	firefox.exe, 0000000D.00000003.1884429400.000001A301452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1964492796.000001A301452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://coverage.mozilla.org	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.13.dr	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	firefox.exe, 0000000D.00000003.1882915007.000001A306043000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	firefox.exe, 0000000D.00000003.1882915007.000001A306043000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000D.00000003.1830912151.000001A305E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1923472982.000001A305E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830296644.000001A305E66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1828346815.000001A305FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blocked.cdn.mozilla.net/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2019-09/schema	firefox.exe, 0000000D.00000003.1831881787.000001A2FED67000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://profiler.firefox.com	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000000D.00000003.1798808712.000001A2FBA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA33000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://identity.mozilla.com/apps/relay	firefox.exe, 0000000D.00000003.1994027021.000001A2FFBE5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/_$reparentDisconnectables	firefox.exe, 0000000D.00000003.1831881787.000001A2FED67000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000000D.00000003.1964492796.000001A3014A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1884429400.000001A3014A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 0000000D.00000003.1876994853.000001A2FEA75000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000000D.00000003.1801533892.000001A2FBADA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1929414630.000001A2FBAD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1942071309.000001A2FBADE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798808712.000001A2FBA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA33000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	firefox.exe, 0000000F.00000002.3016514348.00000187A39CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3017064904.0000023F47EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3020658723.0000024DE4103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false	URL Reputation: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000000D.00000003.1884275730.000001A3019D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	firefox.exe, 0000000D.00000003.1895277700.000001A30A2EE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 0000000D.00000003.1795433552.000001A2FDC77000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search	firefox.exe, 0000000D.00000003.1882193503.000001A30608D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1792130968.000001A2FDC1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1831881787.000001A2FED67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1793105046.000001A2FDC5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1791839721.000001A2FDA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1795433552.000001A2FDC77000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000000D.00000003.1884160502.000001A305F13000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://relay.firefox.com/api/v1/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://topsites.services.mozilla.com/cid/	firefox.exe, 0000000F.00000002.3020187566.00000187A3A00000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3014442948.0000023F47D40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3015809394.0000024DE3E70000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://twitter.com/	firefox.exe, 0000000D.00000003.1956475110.000001A30984F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1193802	firefox.exe, 0000000D.00000003.1876994853.000001A2FEA75000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/w3c/csswg-drafts/issues/4650layout.css.grid-template-masonry-value.enabledsetWebT	firefox.exe, 0000000D.00000003.1831881787.000001A2FED67000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://poczta.interia.pl/mh/?mailto=%s	firefox.exe, 0000000D.00000003.1801533892.000001A2FBADA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1929414630.000001A2FBAD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1942071309.000001A2FBADE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1798808712.000001A2FBA1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA33000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/complete/search	firefox.exe, 0000000D.00000003.1882193503.000001A30608D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830959970.000001A2FF30D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1827466382.000001A305E5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830837027.000001A2FF304000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://watch.sling.com/	firefox.exe, 0000000D.00000003.1977443990.000001A30670B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	firefox.exe, 0000000F.00000002.3016514348.00000187A39CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3017064904.0000023F47EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3020658723.0000024DE4103000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.13.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000000D.00000003.1830912151.000001A305E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1923472982.000001A305E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830166918.000001A305E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1830296644.000001A305E66000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://compose.mail.yahoo.co.jp/ym/Compose?To=%s	firefox.exe, 0000000D.00000003.1801533892.000001A2FBADA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1799317498.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1929414630.000001A2FBAD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1797323574.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1942071309.000001A2FBADE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/complete/	firefox.exe, 0000000D.00000003.1828492091.000001A305F61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1883402470.000001A305F56000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
151.101.129.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541690
Start date and time:	2024-10-25 02:17:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@34/34@67/11
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 95% Number of executed functions: 41 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 34.208.54.237, 44.231.229.39, 52.13.186.250, 172.217.18.10, 142.250.185.202, 142.250.181.238, 2.22.61.59, 2.22.61.56, 172.217.18.14
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, safebrowsing.googleapis.com, location.services.mozilla.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:18:18	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.117.188.166	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
34.149.100.209	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
151.101.129.91	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
34.160.144.191	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
star-mini.c10r.facebook.com	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.253.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.251.35
	http://ylh2qh022.spreadsheetninjas.com/q3bCCwDV?sub1=ed10U&keyword=rbraley@avitusgroup.com&sub2=xelosv.nl	Get hash	malicious	Porn Scam	Browse	157.240.253.35
	http://scansourcce.com/	Get hash	malicious	Unknown	Browse	157.240.0.35
	file.exe	Get hash	malicious	Unknown	Browse	157.240.253.35
	http://elliottconnie.com/	Get hash	malicious	Unknown	Browse	157.240.253.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.252.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.252.35
	file.exe	Get hash	malicious	Unknown	Browse	157.240.0.35
twitter.com	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Unknown	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	file.exe	Get hash	malicious	Unknown	Browse	104.244.42.193
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
ATGS-MMD-ASUS	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	http://elliottconnie.com/	Get hash	malicious	Unknown	Browse	34.149.120.3
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fwe4uproducts.com/cbb/lld/jjg/5BVvnI7cfJ4HfuhWZvVda7dK/am9yZGFuLmJsYWNrQGxlYXJmaWVsZC5jb20=	Get hash	malicious	Unknown	Browse	34.49.241.189
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	33.66.95.206
FASTLYUS	http://toungeassociates-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	http://scansourcce.com/	Get hash	malicious	Unknown	Browse	151.101.2.137
	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
	http://elliottconnie.com/	Get hash	malicious	Unknown	Browse	199.232.210.84
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fwe4uproducts.com/cbb/lld/jjg/5BVvnI7cfJ4HfuhWZvVda7dK/am9yZGFuLmJsYWNrQGxlYXJmaWVsZC5jb20=	Get hash	malicious	Unknown	Browse	151.101.194.137
	General Agreement.docx.exe	Get hash	malicious	Python Stealer, Babadeda, Exela Stealer, Waltuhium Grabber	Browse	185.199.111.133
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
ATGS-MMD-ASUS	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	http://elliottconnie.com/	Get hash	malicious	Unknown	Browse	34.149.120.3
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fwe4uproducts.com/cbb/lld/jjg/5BVvnI7cfJ4HfuhWZvVda7dK/am9yZGFuLmJsYWNrQGxlYXJmaWVsZC5jb20=	Get hash	malicious	Unknown	Browse	34.49.241.189
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	33.66.95.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_86eb8470-c60d-4f76-9c03-3ab2cebecb21.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.179554954842199
Encrypted:	false
SSDEEP:	192:EjMXGgzcbhbVbTbfbRbObtbyEl7nwrpJA6WnSrDtTUd/SkDrS:EYzcNhnzFSJQrEBnSrDhUd/A
MD5:	C7A4EA2A09550D542E06AB507E552641
SHA1:	197D8B8398C0172282B772D0CDF8206E814E520C
SHA-256:	409BCA060F596C0037C432FC778303F0D09B4E388E5576B4C2A734AA6492ACB6
SHA-512:	6D2F5B51A7D728FF5D1517596F27C5F0E5BD1F75C8477EA3A2D84FA6E8586DC8A2B3955D9414A8BC11F6AF00ED5ADDF288A1CBBE7AFD2060007D8C16C3EA5CF3
Malicious:	false
Preview:	{"type":"uninstall","id":"86eb8470-c60d-4f76-9c03-3ab2cebecb21","creationDate":"2024-10-25T01:40:52.212Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_86eb8470-c60d-4f76-9c03-3ab2cebecb21.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.179554954842199
Encrypted:	false
SSDEEP:	192:EjMXGgzcbhbVbTbfbRbObtbyEl7nwrpJA6WnSrDtTUd/SkDrS:EYzcNhnzFSJQrEBnSrDhUd/A
MD5:	C7A4EA2A09550D542E06AB507E552641
SHA1:	197D8B8398C0172282B772D0CDF8206E814E520C
SHA-256:	409BCA060F596C0037C432FC778303F0D09B4E388E5576B4C2A734AA6492ACB6
SHA-512:	6D2F5B51A7D728FF5D1517596F27C5F0E5BD1F75C8477EA3A2D84FA6E8586DC8A2B3955D9414A8BC11F6AF00ED5ADDF288A1CBBE7AFD2060007D8C16C3EA5CF3
Malicious:	false
Preview:	{"type":"uninstall","id":"86eb8470-c60d-4f76-9c03-3ab2cebecb21","creationDate":"2024-10-25T01:40:52.212Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.929599702071556
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakN6EX:8S+OfJQPUFpOdwNIOdYVjvYcXaNLJT8P
MD5:	43864BDAD70AC8EA9A35F19256B20692
SHA1:	962A6E00755BB5A7B980CCD358848EF20100D5F7
SHA-256:	01C6076C4901B62B989168B8FAF5CCB4A8FB60956944282B6E7463222E675A29
SHA-512:	45AE89558BE9B39C1E3BEC945854236137D541704197893C95819E272183875CCF68E26C7CBF004E9DACF1B615D83A245412A93F2A8E980CF1A908F9B6539BE8
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.929599702071556
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakN6EX:8S+OfJQPUFpOdwNIOdYVjvYcXaNLJT8P
MD5:	43864BDAD70AC8EA9A35F19256B20692
SHA1:	962A6E00755BB5A7B980CCD358848EF20100D5F7
SHA-256:	01C6076C4901B62B989168B8FAF5CCB4A8FB60956944282B6E7463222E675A29
SHA-512:	45AE89558BE9B39C1E3BEC945854236137D541704197893C95819E272183875CCF68E26C7CBF004E9DACF1B615D83A245412A93F2A8E980CF1A908F9B6539BE8
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0733666067446506
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki:DLhesh7Owd4+ji
MD5:	AB58CE33C7D72B5204FF06F244259A96
SHA1:	2C6622621491177343530119B741C525BBF4BC10
SHA-256:	4DE65A3045D411FF001A47FF3246ADB818892FD2200C0B4ECABEAD3BC09145FF
SHA-512:	0C584019393A30DA981F109F39D70A5CB486B6846FB8E0187E8EC3ACF2CCF6AF9A63B1AF4EB8BF003AE229EAF3C0A52DB8DA16048CC9A51221C25AA184B0D8A2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035822017202226504
Encrypted:	false
SSDEEP:	3:GtlstF5/QXYmUywQZaoltlstF5/QXYmUywQZCZ89//alEl:GtWtpmrHjltWtpmrHW89XuM
MD5:	7FD6B95151B05A19C04C72045BD57E98
SHA1:	B7C4EE1B8828B2618D50B0C45B37A2DB635286BA
SHA-256:	63B8E9523225D22FE567E5FCA145A583D5D1CA16B2A228471EA0260C2B0BEA48
SHA-512:	7E059F1DDD81449C0E75F6EBEB836CEF5F347014BBFD4E441BDC7333B41DD72B1A810E510499FD0A73C995D8B9A8FF45D491A0668FF568B7CDD05DB4E26E3434
Malicious:	false
Preview:	..-........................2S...A..J..4L;_.O...-........................2S...A..J..4L;_.O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03978988187853101
Encrypted:	false
SSDEEP:	3:Ol1UkRyM/3m8fNzltl8rEXsxdwhml8XW3R2:KXd3l8dMhm93w
MD5:	2E2B08C2B2296F37E3328D88DC65EFAE
SHA1:	BEE16C304303AC9EBAE6FFAD0FA843561FD7B4F3
SHA-256:	9E1D598687C1A961037DF353128F0B15DBC962C051D6CC154677CBA142640B41
SHA-512:	8262AEDCDB49159281B7010CF77BAD753C1002A61D80DA4260A6003B86F2D9BF80550DDCC9B5F319BBFEA991B24DE3B083042D549FD1AFD283B262A23CDDC293
Malicious:	false
Preview:	7....-............A..J..d..].Ke..........A..J.....S2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.494213618207909
Encrypted:	false
SSDEEP:	192:gnaRtLYbBp67hj4qyaaXa6Km2NJu5RfGNBw8dUSl:9eNqO9ykcwz0
MD5:	8BF134FC89323B11177C59E897EA7AE7
SHA1:	6F5DBC0700CD6CB0E0CB4B05B4AD73EE2E032762
SHA-256:	CF43DC6692A3DD739FA3335B00FB9E0F25757BFCCDEB9F9A9C2DA775F28FB787
SHA-512:	928955A5742991C65FE1CE9844FE5B391A79178D588AF226EA8FD9C24AB5C88C62DC9912B9D141F5A2056837E1FE749B91F22D50422DBEA7D931CAFDE9B81077
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729820422);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729820422);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729820422);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172982

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.494213618207909
Encrypted:	false
SSDEEP:	192:gnaRtLYbBp67hj4qyaaXa6Km2NJu5RfGNBw8dUSl:9eNqO9ykcwz0
MD5:	8BF134FC89323B11177C59E897EA7AE7
SHA1:	6F5DBC0700CD6CB0E0CB4B05B4AD73EE2E032762
SHA-256:	CF43DC6692A3DD739FA3335B00FB9E0F25757BFCCDEB9F9A9C2DA775F28FB787
SHA-512:	928955A5742991C65FE1CE9844FE5B391A79178D588AF226EA8FD9C24AB5C88C62DC9912B9D141F5A2056837E1FE749B91F22D50422DBEA7D931CAFDE9B81077
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729820422);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729820422);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729820422);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172982

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO
MD5:	18F65713B07CB441E6A98655B726D098
SHA1:	2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88
SHA-256:	B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621
SHA-512:	A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	6.32663783558439
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSim2LXnIgES4/pnxQwRlszT5sKt0q3eHVQj6TWamhujJF6tOsIomNy:GUpOxZm20nR6n3eHTW4JF6tIquR4
MD5:	1AE903AC74D67D66CA31E008198173C4
SHA1:	7981551D8A210CC723B8DD6B33125236BB3EF4E3
SHA-256:	05211B2EBBC3FEB9EE2185756E8A81FDCE4405FA9D046076041B0461C048237C
SHA-512:	1CB38C7F0E6B301A50F37E2CFBAA53B380EF693C9C80A375164302F7EF196466E7C033E8B29E1DE456B6352E90165C96BEFD557C01B460800CB109E25B83F967
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{e9daf51a-276a-4c6f-be3e-e420f5f76863}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729820427940,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..jUpdate.....vtartTim..`392157...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....398212,"originA.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	6.32663783558439
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSim2LXnIgES4/pnxQwRlszT5sKt0q3eHVQj6TWamhujJF6tOsIomNy:GUpOxZm20nR6n3eHTW4JF6tIquR4
MD5:	1AE903AC74D67D66CA31E008198173C4
SHA1:	7981551D8A210CC723B8DD6B33125236BB3EF4E3
SHA-256:	05211B2EBBC3FEB9EE2185756E8A81FDCE4405FA9D046076041B0461C048237C
SHA-512:	1CB38C7F0E6B301A50F37E2CFBAA53B380EF693C9C80A375164302F7EF196466E7C033E8B29E1DE456B6352E90165C96BEFD557C01B460800CB109E25B83F967
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{e9daf51a-276a-4c6f-be3e-e420f5f76863}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729820427940,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..jUpdate.....vtartTim..`392157...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....398212,"originA.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	6.32663783558439
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSim2LXnIgES4/pnxQwRlszT5sKt0q3eHVQj6TWamhujJF6tOsIomNy:GUpOxZm20nR6n3eHTW4JF6tIquR4
MD5:	1AE903AC74D67D66CA31E008198173C4
SHA1:	7981551D8A210CC723B8DD6B33125236BB3EF4E3
SHA-256:	05211B2EBBC3FEB9EE2185756E8A81FDCE4405FA9D046076041B0461C048237C
SHA-512:	1CB38C7F0E6B301A50F37E2CFBAA53B380EF693C9C80A375164302F7EF196466E7C033E8B29E1DE456B6352E90165C96BEFD557C01B460800CB109E25B83F967
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{e9daf51a-276a-4c6f-be3e-e420f5f76863}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729820427940,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..jUpdate.....vtartTim..`392157...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....398212,"originA.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.033715780736769
Encrypted:	false
SSDEEP:	48:YrSAYJ6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyJW:ycJyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	E8D225ED8BC3A5EB0C75C8381DF60D39
SHA1:	BF420B083CDDE188471C142C3D45C7E7E3ACA52E
SHA-256:	09F194F2059309ABD1DC8CFC2D2B253904DCE4CE5311F4A1A7DDDA126D3DD8C2
SHA-512:	A5FB54CD7AF882C256380A20E2381920959524FA297916FABA754D7EEB9E463FF88219A29C2D6A25282880123CA84C2A542D6F1C11CCB2FA2B37611BD9799DC9
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-25T01:40:07.660Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.033715780736769
Encrypted:	false
SSDEEP:	48:YrSAYJ6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyJW:ycJyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	E8D225ED8BC3A5EB0C75C8381DF60D39
SHA1:	BF420B083CDDE188471C142C3D45C7E7E3ACA52E
SHA-256:	09F194F2059309ABD1DC8CFC2D2B253904DCE4CE5311F4A1A7DDDA126D3DD8C2
SHA-512:	A5FB54CD7AF882C256380A20E2381920959524FA297916FABA754D7EEB9E463FF88219A29C2D6A25282880123CA84C2A542D6F1C11CCB2FA2B37611BD9799DC9
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-25T01:40:07.660Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.584664151607183
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	919'552 bytes
MD5:	ae1078e39c36c64162fa9537c6626fda
SHA1:	670b5241741e03878bef70ca298e339bd221bf13
SHA256:	c5a8e24da16df065a785c3545b812009e8896b54561308e1eb0bb93fe517e851
SHA512:	dfa57b1df9138dbd7d59dcd83f9b6469af17f82a2ffa73c89a4b9dcb0f5360b91e7a7f920017c6a0e038a10ff2f2a2337c982aed9ffda47c690570195dd59d53
SSDEEP:	12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TI:8qDEvCTbMWu7rQYlBQcBiT6rprG8abI
TLSH:	B9159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671AE32C [Fri Oct 25 00:15:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FD20CCFB313h
jmp 00007FD20CCFAC1Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD20CCFADFDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD20CCFADCAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FD20CCFD9BDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FD20CCFDA08h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FD20CCFD9F1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x9c28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x9c28	0x9e00	3bc679af8475cf241680857501542040	False	0.31559038765822783	data	5.373474699000019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0xef0	data			1.0028765690376569
RT_GROUP_ICON	0xdd6a8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd720	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd734	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd748	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd75c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd838	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 02:18:11.729592085 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:11.729724884 CEST	443	49736	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:11.737966061 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:11.744482994 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:11.744534016 CEST	443	49736	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:12.363765955 CEST	443	49736	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:12.363785028 CEST	443	49736	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:12.367362976 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:12.377540112 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:12.377566099 CEST	443	49736	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:12.377654076 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:12.377981901 CEST	443	49736	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:12.378412008 CEST	49736	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:13.994059086 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:13.999569893 CEST	80	49739	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:14.012305975 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.013364077 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.018783092 CEST	80	49739	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:14.421747923 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:14.421792984 CEST	443	49741	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:14.421989918 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:14.423448086 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:14.423463106 CEST	443	49741	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:14.433727980 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:14.433768034 CEST	443	49742	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:14.433907986 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:14.435293913 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:14.435318947 CEST	443	49742	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:14.439744949 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:14.439758062 CEST	443	49743	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:14.440057039 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:14.440185070 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:14.440201044 CEST	443	49743	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:14.607646942 CEST	80	49739	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:14.608782053 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:14.608865976 CEST	443	49744	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:14.609518051 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:14.609653950 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:14.609674931 CEST	443	49744	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:14.651746035 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.926594019 CEST	80	49739	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:14.926800966 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.931175947 CEST	49745	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.937020063 CEST	80	49745	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:14.944581985 CEST	49745	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.977888107 CEST	49745	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:14.983227968 CEST	80	49745	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:15.049422979 CEST	443	49741	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.050478935 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.054446936 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.054455042 CEST	443	49741	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.054538012 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.054662943 CEST	443	49741	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.054821968 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.054857969 CEST	443	49747	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.054927111 CEST	49741	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.054948092 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.056087017 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.056102991 CEST	443	49747	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.058948040 CEST	443	49742	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.059017897 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.059885025 CEST	443	49743	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:15.060271025 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:15.063061953 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:15.063071012 CEST	443	49743	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:15.063499928 CEST	443	49743	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:15.065747976 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.065764904 CEST	443	49742	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.065778017 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:15.065830946 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:15.065929890 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.065968990 CEST	443	49743	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:15.065994024 CEST	443	49742	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.066178083 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.066193104 CEST	443	49748	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.066235065 CEST	49743	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:15.066251993 CEST	49742	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.066339016 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.067431927 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.067441940 CEST	443	49748	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.105029106 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.113097906 CEST	80	49739	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:15.113198042 CEST	49739	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.226939917 CEST	443	49744	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.227026939 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.229999065 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.230021000 CEST	443	49744	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.230362892 CEST	443	49744	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.232966900 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.233119965 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.233213902 CEST	443	49744	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.233535051 CEST	49744	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.233557940 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.233582020 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.233937979 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.234033108 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.234040976 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.364188910 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.370973110 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:15.384957075 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.385220051 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.391858101 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:15.546291113 CEST	80	49745	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:15.556297064 CEST	49745	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.565485001 CEST	80	49745	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:15.569873095 CEST	49745	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:15.678297997 CEST	443	49747	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.683346987 CEST	443	49747	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.683381081 CEST	443	49748	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.685796022 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.685807943 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.768765926 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.768794060 CEST	443	49747	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.768826962 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.769110918 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.769124985 CEST	443	49748	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.769167900 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.769288063 CEST	443	49747	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.769902945 CEST	443	49748	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:15.780220032 CEST	49747	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.780236006 CEST	49748	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:15.840905905 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.841008902 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.844880104 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.844886065 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.845225096 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.847465038 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.847635984 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.847670078 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:15.847676039 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:15.981323957 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.028251886 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.055371046 CEST	443	49750	34.160.144.191	192.168.2.4
Oct 25, 2024 02:18:16.055485010 CEST	49750	443	192.168.2.4	34.160.144.191
Oct 25, 2024 02:18:16.151252985 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.151310921 CEST	443	49752	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:16.166567087 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.167968988 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.168001890 CEST	443	49752	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:16.204613924 CEST	49754	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.205853939 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.210129976 CEST	80	49754	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.211267948 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.213229895 CEST	49754	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.213396072 CEST	49754	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.218760967 CEST	80	49754	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.330549002 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.357017994 CEST	49754	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.370414972 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.375818968 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.381299973 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.381299973 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.381793976 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.386831045 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.405442953 CEST	80	49754	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.700675011 CEST	80	49754	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:16.700742960 CEST	49754	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:16.785350084 CEST	443	49752	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:16.785368919 CEST	443	49752	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:16.785439968 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.790148020 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.790184021 CEST	443	49752	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:16.790231943 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.790411949 CEST	443	49752	34.117.188.166	192.168.2.4
Oct 25, 2024 02:18:16.790472031 CEST	49752	443	192.168.2.4	34.117.188.166
Oct 25, 2024 02:18:16.985757113 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:17.027355909 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:18.805742025 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:18.805809021 CEST	443	49757	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:18.813061953 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:18.814152002 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:18.814182043 CEST	443	49757	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:18.839216948 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:18.844671011 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:18.964737892 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:19.000335932 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:19.000396013 CEST	443	49758	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:19.004426003 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:19.005847931 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:19.005876064 CEST	443	49758	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:19.010799885 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:19.013523102 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:19.016216993 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:19.028637886 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:19.028664112 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:19.035706997 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:19.035990000 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:19.036005020 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:19.044435024 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:19.044497013 CEST	443	49760	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:19.051234961 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:19.052467108 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:19.052496910 CEST	443	49760	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:19.138534069 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:19.198546886 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:19.420681953 CEST	443	49757	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:19.420701981 CEST	443	49757	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:19.420766115 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:19.628890991 CEST	443	49758	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:19.628990889 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:19.640980005 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:19.641015053 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:19.646785021 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:19.677280903 CEST	443	49760	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:19.677299023 CEST	443	49760	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:19.677424908 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:20.260545015 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:20.260571003 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:20.261028051 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:20.264848948 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:20.264849901 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:20.264905930 CEST	443	49757	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:20.265083075 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:20.265115023 CEST	443	49758	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:20.265232086 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:20.265527010 CEST	443	49757	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:20.265621901 CEST	443	49758	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:20.267292976 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:20.267338991 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:20.267431021 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:20.267458916 CEST	443	49760	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:20.267472982 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:20.267723083 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:20.267982960 CEST	443	49760	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:20.271902084 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:20.271903992 CEST	49757	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:20.271903992 CEST	49758	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:20.272288084 CEST	49760	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:20.272311926 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:25.061136961 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:25.066642046 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:25.089265108 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.089287043 CEST	443	49763	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.089684963 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.091109991 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.091124058 CEST	443	49763	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.187577963 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:25.229603052 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:25.636811018 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:25.642225981 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:25.654530048 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.654556036 CEST	443	49765	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.656016111 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.656184912 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.656193018 CEST	443	49765	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.666866064 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.666909933 CEST	443	49766	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.667929888 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.668028116 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.668046951 CEST	443	49766	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.709844112 CEST	443	49763	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.710038900 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.714443922 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.714453936 CEST	443	49763	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.714565992 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.714593887 CEST	443	49763	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:25.715538979 CEST	49763	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:25.763334036 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:25.815720081 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:25.840786934 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:25.840858936 CEST	443	49768	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:25.847054958 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:25.848318100 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:25.848350048 CEST	443	49768	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:26.074234962 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:26.079687119 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:26.099108934 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.099134922 CEST	443	49769	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.099826097 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.101358891 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.101371050 CEST	443	49769	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.200506926 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:26.233994007 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:26.234016895 CEST	443	49770	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:26.236257076 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:26.237721920 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:26.237735033 CEST	443	49770	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:26.248157024 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:26.273421049 CEST	443	49765	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.275152922 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.278575897 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.278589010 CEST	443	49765	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.279063940 CEST	443	49765	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.293550014 CEST	443	49766	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.293651104 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.332834959 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.357270956 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.357295036 CEST	443	49766	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.358287096 CEST	443	49766	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.359580040 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.359698057 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.360246897 CEST	443	49765	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.360532999 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.360532999 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.360687971 CEST	49765	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.360965014 CEST	443	49766	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.363185883 CEST	49766	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.467941046 CEST	443	49768	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:26.473910093 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:26.717470884 CEST	443	49769	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:26.717551947 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:26.850991011 CEST	443	49770	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:26.859334946 CEST	443	49770	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:26.859814882 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:26.859903097 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:27.068681002 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:27.072570086 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:27.072588921 CEST	443	49769	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:27.072665930 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:27.072765112 CEST	443	49769	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:27.072797060 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:27.072834015 CEST	443	49768	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:27.072860956 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:27.072964907 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:27.072977066 CEST	443	49770	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:27.073018074 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:27.073290110 CEST	443	49770	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:27.073437929 CEST	443	49768	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:27.073540926 CEST	49769	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:27.073663950 CEST	49770	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:27.073681116 CEST	49768	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:27.074177980 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:27.195725918 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:27.251194954 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:28.147485018 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:28.149189949 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.149213076 CEST	443	49773	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.150650978 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.150808096 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.150815964 CEST	443	49773	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.152967930 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:28.272924900 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:28.315700054 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:28.339004040 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.339040995 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.339497089 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.341327906 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.341346025 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.552711964 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:28.558104992 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:28.679852009 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:28.732368946 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:28.768261909 CEST	443	49773	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.768346071 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.772593021 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.772624969 CEST	443	49773	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.772907972 CEST	443	49773	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.775863886 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.775949001 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.776046038 CEST	443	49773	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.776108980 CEST	49773	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:28.962425947 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:28.962572098 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.229130983 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.229154110 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:29.229212046 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.229664087 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:29.233623981 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.787276983 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:29.788153887 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.788213015 CEST	443	49775	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:29.788696051 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.788836002 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.788850069 CEST	443	49775	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:29.792646885 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:29.793822050 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.793852091 CEST	443	49776	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:29.793994904 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.795331955 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:29.795341969 CEST	443	49776	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:29.912046909 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:29.957964897 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:29.961667061 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:29.967106104 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:30.089684963 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:30.136398077 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:30.397496939 CEST	443	49775	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.397593975 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.422908068 CEST	443	49776	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.423110962 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.462918997 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.463006020 CEST	443	49775	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.463296890 CEST	443	49775	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.467401981 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.467498064 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.467587948 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.467603922 CEST	443	49776	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.467653036 CEST	443	49775	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.467664003 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.467936039 CEST	49775	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.468056917 CEST	443	49776	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.468127012 CEST	49776	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.848622084 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:30.853972912 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:30.878963947 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.878999949 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.880065918 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.881583929 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:30.881598949 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:30.973808050 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:30.976738930 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:30.982009888 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.023329973 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.104443073 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.161402941 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.496761084 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:31.496856928 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:31.502446890 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:31.502454042 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:31.502600908 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:31.502996922 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 25, 2024 02:18:31.504586935 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:18:31.505122900 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.510704041 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.630611897 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.634372950 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.639821053 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.678529978 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.734637976 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.739976883 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.760940075 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.815232992 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.859831095 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.863852978 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.869287968 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:31.910368919 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:31.992276907 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:32.041917086 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:38.770402908 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:38.770436049 CEST	443	49779	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:38.771008968 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:38.772898912 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:38.772913933 CEST	443	49779	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:39.379889965 CEST	443	49779	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:39.379990101 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:39.384712934 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:39.384718895 CEST	443	49779	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:39.384824991 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:39.384922981 CEST	443	49779	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:39.385045052 CEST	49779	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:39.388614893 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:39.394092083 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:39.513967037 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:39.517558098 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:39.522967100 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:39.563756943 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:39.645982981 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:39.686233997 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:40.328675985 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.328694105 CEST	443	49780	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:40.328742981 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.328859091 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.328880072 CEST	443	49780	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:40.329978943 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.330008030 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.330156088 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.330250025 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.330256939 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.336796999 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.336879969 CEST	443	49782	151.101.129.91	192.168.2.4
Oct 25, 2024 02:18:40.337070942 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.337215900 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.337244987 CEST	443	49782	151.101.129.91	192.168.2.4
Oct 25, 2024 02:18:40.928349018 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:40.928381920 CEST	443	49783	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:40.930872917 CEST	443	49780	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:40.931329966 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:40.932878971 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:40.932892084 CEST	443	49783	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:40.933542967 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.936985970 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.936999083 CEST	443	49780	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:40.937220097 CEST	443	49780	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:40.940329075 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.940399885 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.940507889 CEST	443	49780	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:40.944256067 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.944281101 CEST	49780	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:40.945163012 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:40.945203066 CEST	443	49784	35.201.103.21	192.168.2.4
Oct 25, 2024 02:18:40.947820902 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.952368021 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:40.952368021 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.956641912 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.956656933 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.957525015 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.958808899 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:40.958823919 CEST	443	49784	35.201.103.21	192.168.2.4
Oct 25, 2024 02:18:40.961716890 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.961716890 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.962392092 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.965827942 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:40.967372894 CEST	443	49781	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:40.968111038 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.968111038 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.968111038 CEST	49781	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:40.971205950 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:40.987427950 CEST	443	49782	151.101.129.91	192.168.2.4
Oct 25, 2024 02:18:40.988218069 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.991456032 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.991511106 CEST	443	49782	151.101.129.91	192.168.2.4
Oct 25, 2024 02:18:40.991935015 CEST	443	49782	151.101.129.91	192.168.2.4
Oct 25, 2024 02:18:40.994899988 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.994899988 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.995100975 CEST	443	49782	151.101.129.91	192.168.2.4
Oct 25, 2024 02:18:40.995138884 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:40.995173931 CEST	49782	443	192.168.2.4	151.101.129.91
Oct 25, 2024 02:18:41.011655092 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.011694908 CEST	443	49785	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.011831045 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.011914968 CEST	443	49786	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.012025118 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012063026 CEST	443	49787	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.012087107 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012223005 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012312889 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012342930 CEST	443	49786	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.012362003 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012404919 CEST	443	49785	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.012558937 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012629986 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.012638092 CEST	443	49787	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.090632915 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.093805075 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:41.099306107 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.137161970 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:41.221190929 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.291019917 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:41.553558111 CEST	443	49783	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:41.553884029 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:41.558429956 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:41.558438063 CEST	443	49783	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:41.558664083 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:41.558681965 CEST	443	49783	35.190.72.216	192.168.2.4
Oct 25, 2024 02:18:41.560950041 CEST	49783	443	192.168.2.4	35.190.72.216
Oct 25, 2024 02:18:41.563371897 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:41.569123983 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.579046965 CEST	443	49784	35.201.103.21	192.168.2.4
Oct 25, 2024 02:18:41.579057932 CEST	443	49784	35.201.103.21	192.168.2.4
Oct 25, 2024 02:18:41.579226017 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:41.583432913 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:41.583460093 CEST	443	49784	35.201.103.21	192.168.2.4
Oct 25, 2024 02:18:41.583529949 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:41.583683968 CEST	443	49784	35.201.103.21	192.168.2.4
Oct 25, 2024 02:18:41.584017992 CEST	49784	443	192.168.2.4	35.201.103.21
Oct 25, 2024 02:18:41.614418030 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:41.614451885 CEST	443	49788	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:41.614818096 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:41.614975929 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:41.614984035 CEST	443	49788	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:41.619771957 CEST	443	49785	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.619868994 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.622648954 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.622678041 CEST	443	49785	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.622900009 CEST	443	49785	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.623821020 CEST	443	49786	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.624526024 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.626754045 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.626782894 CEST	443	49786	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.627383947 CEST	443	49786	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.627648115 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.627734900 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.627774954 CEST	443	49785	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.628835917 CEST	49785	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.629961014 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.630033016 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.630256891 CEST	443	49786	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.634268999 CEST	49786	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.645032883 CEST	443	49787	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.645225048 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.647495985 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.647525072 CEST	443	49787	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.647866011 CEST	443	49787	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.649512053 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.649585962 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.649703979 CEST	443	49787	35.244.181.201	192.168.2.4
Oct 25, 2024 02:18:41.649842978 CEST	49787	443	192.168.2.4	35.244.181.201
Oct 25, 2024 02:18:41.690155029 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.692677021 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:41.699448109 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.737818956 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:41.819159985 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:41.869503021 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:42.238415956 CEST	443	49788	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:42.238544941 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:42.242089033 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:42.242094040 CEST	443	49788	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:42.242324114 CEST	443	49788	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:42.244523048 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:42.244677067 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:42.244731903 CEST	443	49788	34.149.100.209	192.168.2.4
Oct 25, 2024 02:18:42.249636889 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:42.253534079 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:42.253534079 CEST	49788	443	192.168.2.4	34.149.100.209
Oct 25, 2024 02:18:42.255105972 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:42.375355005 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:42.379240036 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:42.384613991 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:42.424037933 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:42.506150007 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:42.555577040 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:52.388093948 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:52.393459082 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:52.519762993 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:18:52.525182962 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:18:59.620234013 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:59.620259047 CEST	443	49801	34.107.243.93	192.168.2.4
Oct 25, 2024 02:18:59.620374918 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:59.622317076 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:18:59.622332096 CEST	443	49801	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:00.241695881 CEST	443	49801	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:00.241990089 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:00.246823072 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:00.246833086 CEST	443	49801	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:00.246933937 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:00.246997118 CEST	443	49801	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:00.249311924 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:00.251061916 CEST	49801	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:00.254631042 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:00.374550104 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:00.377135038 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:00.382564068 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:00.426944017 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:00.503554106 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:00.558836937 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:10.198149920 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.198184967 CEST	443	49863	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.198558092 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.198657990 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.198671103 CEST	443	49863	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.232125998 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.232178926 CEST	443	49864	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.232851028 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.233011961 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.233038902 CEST	443	49864	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.235163927 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.235235929 CEST	443	49865	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.235857964 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.236000061 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.236022949 CEST	443	49865	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.386209965 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:10.391552925 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:10.524275064 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:10.529784918 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:10.835045099 CEST	443	49863	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.835155964 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.838207960 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.838213921 CEST	443	49863	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.838963032 CEST	443	49863	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.841088057 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.841161013 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.841475010 CEST	443	49863	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.846446037 CEST	49863	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.848911047 CEST	443	49865	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.849031925 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.851733923 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.851753950 CEST	443	49865	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.852086067 CEST	443	49865	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.854408979 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.854481936 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.854576111 CEST	443	49865	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.856209040 CEST	49865	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.862128973 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:10.868849993 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:10.880343914 CEST	443	49864	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.880450010 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.882927895 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.882942915 CEST	443	49864	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.883507967 CEST	443	49864	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.885406017 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.885504007 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.885590076 CEST	443	49864	34.120.208.123	192.168.2.4
Oct 25, 2024 02:19:10.885833025 CEST	49864	443	192.168.2.4	34.120.208.123
Oct 25, 2024 02:19:10.987746954 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:11.021254063 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:11.026680946 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:11.041326046 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:11.147706985 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:11.188458920 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:21.001754999 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:21.007386923 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:21.155531883 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:21.160973072 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:31.014012098 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:31.019406080 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:31.183712959 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:31.189173937 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:40.515331984 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:40.515360117 CEST	443	50034	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:40.515420914 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:40.516655922 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:40.516674042 CEST	443	50034	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:41.027705908 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:41.154321909 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:41.161771059 CEST	443	50034	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:41.161845922 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:41.168093920 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:41.168107033 CEST	443	50034	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:41.168234110 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:41.168353081 CEST	443	50034	34.107.243.93	192.168.2.4
Oct 25, 2024 02:19:41.168981075 CEST	50034	443	192.168.2.4	34.107.243.93
Oct 25, 2024 02:19:41.171013117 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:41.176340103 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:41.190233946 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:41.195607901 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:41.295770884 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:41.299289942 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:41.304661036 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:41.343894005 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:41.426075935 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:41.475841999 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:51.302321911 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:51.307904959 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:19:51.440305948 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:19:51.445818901 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:20:01.319205999 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:20:01.325056076 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:20:01.450840950 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:20:01.456304073 CEST	80	49756	34.107.221.82	192.168.2.4
Oct 25, 2024 02:20:11.342331886 CEST	49751	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:20:11.347923994 CEST	80	49751	34.107.221.82	192.168.2.4
Oct 25, 2024 02:20:11.457808018 CEST	49756	80	192.168.2.4	34.107.221.82
Oct 25, 2024 02:20:11.463275909 CEST	80	49756	34.107.221.82	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 02:18:11.730407953 CEST	52697	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:11.751236916 CEST	53	52697	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:11.752523899 CEST	60426	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:11.760108948 CEST	53	60426	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:13.855896950 CEST	51197	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:13.856134892 CEST	49352	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:13.863842010 CEST	53	49352	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:13.867774010 CEST	58320	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:13.875137091 CEST	53	58320	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:13.876961946 CEST	62023	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:13.881592989 CEST	61040	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:13.884504080 CEST	53	62023	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:13.889583111 CEST	53	61040	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:13.889709949 CEST	61811	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:13.897319078 CEST	53	61811	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.411582947 CEST	53995	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.418999910 CEST	53	53995	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.421966076 CEST	53742	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.425261021 CEST	62533	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.429910898 CEST	53	53742	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.432454109 CEST	53	62533	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.432715893 CEST	60397	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.433856964 CEST	60711	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.439789057 CEST	53	60397	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.439868927 CEST	56132	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.441487074 CEST	53	60711	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.441946983 CEST	59651	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.447802067 CEST	53	56132	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.449887037 CEST	53	59651	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.455260992 CEST	51180	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.463247061 CEST	53	51180	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.598556995 CEST	52020	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.606142998 CEST	53	52020	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.609174967 CEST	65445	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.616703033 CEST	53	65445	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.621356964 CEST	65060	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.628427982 CEST	53	65060	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.671736002 CEST	54266	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.672151089 CEST	55976	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.716489077 CEST	53798	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:14.928838015 CEST	53	55976	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:14.928986073 CEST	53	54266	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:16.190279007 CEST	64076	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:16.244421005 CEST	53	49352	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:16.353950024 CEST	60327	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:16.361844063 CEST	53	60327	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:16.368666887 CEST	56906	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:16.375972033 CEST	53	56906	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:16.381829023 CEST	64227	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:16.388966084 CEST	53	64227	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:18.810626984 CEST	62762	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:18.813429117 CEST	61522	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:18.817890882 CEST	53	62762	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:18.820806980 CEST	53	61522	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:18.837577105 CEST	57983	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:18.845491886 CEST	53	57983	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:18.861680984 CEST	53482	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:18.869785070 CEST	53	53482	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:19.000888109 CEST	62496	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:19.008389950 CEST	53	62496	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:19.010154963 CEST	51236	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:19.017400026 CEST	53	51236	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:19.025923014 CEST	51560	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:19.033824921 CEST	53	51560	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:19.045072079 CEST	59054	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:19.052445889 CEST	53	59054	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:19.054495096 CEST	64086	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:19.061619043 CEST	53	64086	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:25.079001904 CEST	49259	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:25.086349964 CEST	53	49259	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:26.235939026 CEST	62415	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:26.244168043 CEST	53	62415	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.939934015 CEST	55305	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.940282106 CEST	63036	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.943691015 CEST	64302	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.947031975 CEST	53	55305	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.947442055 CEST	53	63036	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.947875977 CEST	55218	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.948569059 CEST	49503	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.950988054 CEST	53	64302	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.951881886 CEST	63021	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.955543041 CEST	53	55218	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.956157923 CEST	54908	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.956465960 CEST	53	49503	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.957329988 CEST	60443	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.959039927 CEST	53	63021	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.959661961 CEST	51943	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.963350058 CEST	53	54908	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.964046001 CEST	53289	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.966630936 CEST	53	60443	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.966741085 CEST	53	51943	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.967674017 CEST	56873	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.971468925 CEST	53	53289	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.972738981 CEST	50637	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.974805117 CEST	53	56873	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.975529909 CEST	55089	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.980125904 CEST	53	50637	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.980823994 CEST	50047	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.982606888 CEST	53	55089	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.983119011 CEST	59990	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:27.988905907 CEST	53	50047	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:27.990770102 CEST	53	59990	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:29.789809942 CEST	58708	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:29.797091961 CEST	53	58708	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:38.771399975 CEST	58860	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:38.778743029 CEST	53	58860	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.325704098 CEST	57921	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.327912092 CEST	59234	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.333344936 CEST	53	57921	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.336026907 CEST	53	59234	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.337024927 CEST	59450	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.346756935 CEST	53	59450	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.350143909 CEST	53836	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.357799053 CEST	53	53836	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.931113005 CEST	51435	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.938744068 CEST	53	51435	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.945807934 CEST	51683	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.953831911 CEST	53	51683	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:40.970881939 CEST	59644	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:40.978405952 CEST	53	59644	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:59.611567020 CEST	63759	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:59.619272947 CEST	53	63759	1.1.1.1	192.168.2.4
Oct 25, 2024 02:18:59.620110035 CEST	61311	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:18:59.627473116 CEST	53	61311	1.1.1.1	192.168.2.4
Oct 25, 2024 02:19:00.249557018 CEST	50435	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:19:10.230412006 CEST	64984	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:19:10.237716913 CEST	53	64984	1.1.1.1	192.168.2.4
Oct 25, 2024 02:19:40.514563084 CEST	54057	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:19:40.521814108 CEST	53	54057	1.1.1.1	192.168.2.4
Oct 25, 2024 02:19:40.523109913 CEST	53272	53	192.168.2.4	1.1.1.1
Oct 25, 2024 02:19:40.530392885 CEST	53	53272	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 02:18:11.730407953 CEST	192.168.2.4	1.1.1.1	0x8b77	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:11.752523899 CEST	192.168.2.4	1.1.1.1	0x6511	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:13.855896950 CEST	192.168.2.4	1.1.1.1	0xbfe1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.856134892 CEST	192.168.2.4	1.1.1.1	0xf279	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.867774010 CEST	192.168.2.4	1.1.1.1	0xff16	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.876961946 CEST	192.168.2.4	1.1.1.1	0x63b0	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.881592989 CEST	192.168.2.4	1.1.1.1	0xcfcf	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:13.889709949 CEST	192.168.2.4	1.1.1.1	0x5159	Standard query (0)	youtube.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:14.411582947 CEST	192.168.2.4	1.1.1.1	0x3aab	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.421966076 CEST	192.168.2.4	1.1.1.1	0xa794	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.425261021 CEST	192.168.2.4	1.1.1.1	0x46ed	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.432715893 CEST	192.168.2.4	1.1.1.1	0x4e63	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:14.433856964 CEST	192.168.2.4	1.1.1.1	0xb60b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.439868927 CEST	192.168.2.4	1.1.1.1	0xf7e6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.441946983 CEST	192.168.2.4	1.1.1.1	0x137d	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:14.455260992 CEST	192.168.2.4	1.1.1.1	0x9395	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:14.598556995 CEST	192.168.2.4	1.1.1.1	0x2aee	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.609174967 CEST	192.168.2.4	1.1.1.1	0xe074	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.621356964 CEST	192.168.2.4	1.1.1.1	0x4099	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:14.671736002 CEST	192.168.2.4	1.1.1.1	0x92ac	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.672151089 CEST	192.168.2.4	1.1.1.1	0xfcc6	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.716489077 CEST	192.168.2.4	1.1.1.1	0xbcb7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:16.190279007 CEST	192.168.2.4	1.1.1.1	0x227f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:16.353950024 CEST	192.168.2.4	1.1.1.1	0x6e65	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:16.368666887 CEST	192.168.2.4	1.1.1.1	0x9843	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:16.381829023 CEST	192.168.2.4	1.1.1.1	0x3875	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:18.810626984 CEST	192.168.2.4	1.1.1.1	0xc40f	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.813429117 CEST	192.168.2.4	1.1.1.1	0xe4a4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.837577105 CEST	192.168.2.4	1.1.1.1	0x281	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.861680984 CEST	192.168.2.4	1.1.1.1	0x1fbd	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:19.000888109 CEST	192.168.2.4	1.1.1.1	0x97e3	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.010154963 CEST	192.168.2.4	1.1.1.1	0x8d6b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:19.025923014 CEST	192.168.2.4	1.1.1.1	0x3273	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.045072079 CEST	192.168.2.4	1.1.1.1	0x2294	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.054495096 CEST	192.168.2.4	1.1.1.1	0x8b0	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:25.079001904 CEST	192.168.2.4	1.1.1.1	0xfaf7	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:26.235939026 CEST	192.168.2.4	1.1.1.1	0xefc8	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:27.939934015 CEST	192.168.2.4	1.1.1.1	0x4f77	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.940282106 CEST	192.168.2.4	1.1.1.1	0x76d2	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.943691015 CEST	192.168.2.4	1.1.1.1	0xf487	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.947875977 CEST	192.168.2.4	1.1.1.1	0x765c	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.948569059 CEST	192.168.2.4	1.1.1.1	0xfd50	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.951881886 CEST	192.168.2.4	1.1.1.1	0xbaa0	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.956157923 CEST	192.168.2.4	1.1.1.1	0x12fa	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:27.957329988 CEST	192.168.2.4	1.1.1.1	0x9485	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Oct 25, 2024 02:18:27.959661961 CEST	192.168.2.4	1.1.1.1	0x5f5f	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:27.964046001 CEST	192.168.2.4	1.1.1.1	0x97e0	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.967674017 CEST	192.168.2.4	1.1.1.1	0xe092	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.972738981 CEST	192.168.2.4	1.1.1.1	0x38e9	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.975529909 CEST	192.168.2.4	1.1.1.1	0xd6fb	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.980823994 CEST	192.168.2.4	1.1.1.1	0x937f	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:27.983119011 CEST	192.168.2.4	1.1.1.1	0x2d16	Standard query (0)	twitter.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:29.789809942 CEST	192.168.2.4	1.1.1.1	0x1edf	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:38.771399975 CEST	192.168.2.4	1.1.1.1	0xfca4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:40.325704098 CEST	192.168.2.4	1.1.1.1	0x1677	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.327912092 CEST	192.168.2.4	1.1.1.1	0x4c2	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 25, 2024 02:18:40.337024927 CEST	192.168.2.4	1.1.1.1	0xd0b4	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.350143909 CEST	192.168.2.4	1.1.1.1	0x634a	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Oct 25, 2024 02:18:40.931113005 CEST	192.168.2.4	1.1.1.1	0xdc06	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.945807934 CEST	192.168.2.4	1.1.1.1	0xb8ab	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.970881939 CEST	192.168.2.4	1.1.1.1	0x9b83	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:18:59.611567020 CEST	192.168.2.4	1.1.1.1	0xb98c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:59.620110035 CEST	192.168.2.4	1.1.1.1	0x810	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:19:00.249557018 CEST	192.168.2.4	1.1.1.1	0x4890	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:19:10.230412006 CEST	192.168.2.4	1.1.1.1	0xdf98	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 25, 2024 02:19:40.514563084 CEST	192.168.2.4	1.1.1.1	0x5cd3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:19:40.523109913 CEST	192.168.2.4	1.1.1.1	0x5451	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 02:18:11.679812908 CEST	1.1.1.1	192.168.2.4	0xd9c2	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:11.751236916 CEST	1.1.1.1	192.168.2.4	0x8b77	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.863260984 CEST	1.1.1.1	192.168.2.4	0xbfe1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:13.863260984 CEST	1.1.1.1	192.168.2.4	0xbfe1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.863842010 CEST	1.1.1.1	192.168.2.4	0xf279	No error (0)	youtube.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.875137091 CEST	1.1.1.1	192.168.2.4	0xff16	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.884504080 CEST	1.1.1.1	192.168.2.4	0x63b0	No error (0)	youtube.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:13.889583111 CEST	1.1.1.1	192.168.2.4	0xcfcf	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Oct 25, 2024 02:18:13.897319078 CEST	1.1.1.1	192.168.2.4	0x5159	No error (0)	youtube.com			28	IN (0x0001)	false
Oct 25, 2024 02:18:14.418999910 CEST	1.1.1.1	192.168.2.4	0x3aab	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.429910898 CEST	1.1.1.1	192.168.2.4	0xa794	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.432454109 CEST	1.1.1.1	192.168.2.4	0x46ed	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:14.432454109 CEST	1.1.1.1	192.168.2.4	0x46ed	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.438921928 CEST	1.1.1.1	192.168.2.4	0xa5dc	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:14.438921928 CEST	1.1.1.1	192.168.2.4	0xa5dc	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.441487074 CEST	1.1.1.1	192.168.2.4	0xb60b	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.447802067 CEST	1.1.1.1	192.168.2.4	0xf7e6	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.606142998 CEST	1.1.1.1	192.168.2.4	0x2aee	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:14.606142998 CEST	1.1.1.1	192.168.2.4	0x2aee	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:14.606142998 CEST	1.1.1.1	192.168.2.4	0x2aee	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.616703033 CEST	1.1.1.1	192.168.2.4	0xe074	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.628427982 CEST	1.1.1.1	192.168.2.4	0x4099	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Oct 25, 2024 02:18:14.928838015 CEST	1.1.1.1	192.168.2.4	0xfcc6	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.928838015 CEST	1.1.1.1	192.168.2.4	0xfcc6	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.928936958 CEST	1.1.1.1	192.168.2.4	0xbcb7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:14.928936958 CEST	1.1.1.1	192.168.2.4	0xbcb7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:14.928986073 CEST	1.1.1.1	192.168.2.4	0x92ac	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:16.198113918 CEST	1.1.1.1	192.168.2.4	0x227f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:16.361844063 CEST	1.1.1.1	192.168.2.4	0x6e65	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:16.375972033 CEST	1.1.1.1	192.168.2.4	0x9843	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.817890882 CEST	1.1.1.1	192.168.2.4	0xc40f	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:18.817890882 CEST	1.1.1.1	192.168.2.4	0xc40f	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:18.817890882 CEST	1.1.1.1	192.168.2.4	0xc40f	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.820806980 CEST	1.1.1.1	192.168.2.4	0xe4a4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.845491886 CEST	1.1.1.1	192.168.2.4	0x281	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:18.986663103 CEST	1.1.1.1	192.168.2.4	0x8162	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.008389950 CEST	1.1.1.1	192.168.2.4	0x97e3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.023480892 CEST	1.1.1.1	192.168.2.4	0xeb49	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:19.023480892 CEST	1.1.1.1	192.168.2.4	0xeb49	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.033824921 CEST	1.1.1.1	192.168.2.4	0x3273	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:19.033824921 CEST	1.1.1.1	192.168.2.4	0x3273	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:19.052445889 CEST	1.1.1.1	192.168.2.4	0x2294	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:25.086036921 CEST	1.1.1.1	192.168.2.4	0x714c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.947031975 CEST	1.1.1.1	192.168.2.4	0x4f77	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:27.947031975 CEST	1.1.1.1	192.168.2.4	0x4f77	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.947442055 CEST	1.1.1.1	192.168.2.4	0x76d2	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:27.947442055 CEST	1.1.1.1	192.168.2.4	0x76d2	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.950988054 CEST	1.1.1.1	192.168.2.4	0xf487	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.955543041 CEST	1.1.1.1	192.168.2.4	0x765c	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.956465960 CEST	1.1.1.1	192.168.2.4	0xfd50	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.959039927 CEST	1.1.1.1	192.168.2.4	0xbaa0	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.963350058 CEST	1.1.1.1	192.168.2.4	0x12fa	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Oct 25, 2024 02:18:27.966630936 CEST	1.1.1.1	192.168.2.4	0x9485	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Oct 25, 2024 02:18:27.966741085 CEST	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 25, 2024 02:18:27.966741085 CEST	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 25, 2024 02:18:27.966741085 CEST	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 25, 2024 02:18:27.966741085 CEST	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 25, 2024 02:18:27.971468925 CEST	1.1.1.1	192.168.2.4	0x97e0	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:27.971468925 CEST	1.1.1.1	192.168.2.4	0x97e0	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.971468925 CEST	1.1.1.1	192.168.2.4	0x97e0	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.971468925 CEST	1.1.1.1	192.168.2.4	0x97e0	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.971468925 CEST	1.1.1.1	192.168.2.4	0x97e0	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.974805117 CEST	1.1.1.1	192.168.2.4	0xe092	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.980125904 CEST	1.1.1.1	192.168.2.4	0x38e9	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.980125904 CEST	1.1.1.1	192.168.2.4	0x38e9	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.980125904 CEST	1.1.1.1	192.168.2.4	0x38e9	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.980125904 CEST	1.1.1.1	192.168.2.4	0x38e9	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:27.982606888 CEST	1.1.1.1	192.168.2.4	0xd6fb	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.325226068 CEST	1.1.1.1	192.168.2.4	0x2199	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:40.325226068 CEST	1.1.1.1	192.168.2.4	0x2199	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.333344936 CEST	1.1.1.1	192.168.2.4	0x1677	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.333344936 CEST	1.1.1.1	192.168.2.4	0x1677	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.333344936 CEST	1.1.1.1	192.168.2.4	0x1677	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.333344936 CEST	1.1.1.1	192.168.2.4	0x1677	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.346756935 CEST	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.346756935 CEST	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.346756935 CEST	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.346756935 CEST	1.1.1.1	192.168.2.4	0xd0b4	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.938744068 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:40.938744068 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:40.953831911 CEST	1.1.1.1	192.168.2.4	0xb8ab	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:18:41.684238911 CEST	1.1.1.1	192.168.2.4	0xdf8b	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:41.684238911 CEST	1.1.1.1	192.168.2.4	0xdf8b	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:18:59.619272947 CEST	1.1.1.1	192.168.2.4	0xb98c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:19:00.258362055 CEST	1.1.1.1	192.168.2.4	0x4890	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 02:19:00.258362055 CEST	1.1.1.1	192.168.2.4	0x4890	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:19:10.204895973 CEST	1.1.1.1	192.168.2.4	0x5466	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 25, 2024 02:19:40.521814108 CEST	1.1.1.1	192.168.2.4	0x5cd3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	34.107.221.82	80	7812	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 02:18:14.013364077 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:14.607646942 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42500 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:14.926594019 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42500 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	34.107.221.82	80	7812	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 02:18:14.977888107 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:15.546291113 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51802 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	34.107.221.82	80	7812	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 02:18:15.385220051 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:15.981323957 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42501 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:16.205853939 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:16.330549002 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42502 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:18.839216948 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:18.964737892 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42504 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:25.061136961 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:25.187577963 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42511 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:26.074234962 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:26.200506926 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42512 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:28.147485018 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:28.272924900 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42514 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:29.787276983 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:29.912046909 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42515 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:30.848622084 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:30.973808050 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42516 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:31.505122900 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:31.630611897 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42517 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:31.734637976 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:31.859831095 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42517 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:39.388614893 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:39.513967037 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42525 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:40.965827942 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:41.090632915 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42527 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:41.563371897 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:41.690155029 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42527 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:42.249636889 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:18:42.375355005 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42528 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:18:52.388093948 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:00.249311924 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:19:00.374550104 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42546 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:19:10.386209965 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:10.862128973 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:19:10.987746954 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42556 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:19:21.001754999 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:31.014012098 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:41.027705908 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:41.171013117 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 25, 2024 02:19:41.295770884 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 24 Oct 2024 12:29:54 GMT Age: 42587 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 25, 2024 02:19:51.302321911 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:20:01.319205999 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:20:11.342331886 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49754	34.107.221.82	80	7812	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 02:18:16.213396072 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49756	34.107.221.82	80	7812	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 02:18:16.381299973 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:16.985757113 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51803 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:19.010799885 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:19.138534069 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51806 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:25.636811018 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:25.763334036 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51812 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:27.068681002 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:27.195725918 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51814 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:28.552711964 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:28.679852009 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51815 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:29.961667061 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:30.089684963 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51817 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:30.976738930 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:31.104443073 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51818 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:31.634372950 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:31.760940075 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51818 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:31.863852978 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:31.992276907 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51818 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:39.517558098 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:39.645982981 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51826 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:41.093805075 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:41.221190929 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51828 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:41.692677021 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:41.819159985 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51828 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:42.379240036 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:18:42.506150007 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51829 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:18:52.519762993 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:00.377135038 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:19:00.503554106 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51847 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:19:10.524275064 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:11.021254063 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:19:11.147706985 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51858 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:19:21.155531883 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:31.183712959 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:41.190233946 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:19:41.299289942 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 25, 2024 02:19:41.426075935 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 24 Oct 2024 09:54:53 GMT Age: 51888 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 25, 2024 02:19:51.440305948 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:20:01.450840950 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 25, 2024 02:20:11.457808018 CEST	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	20:18:05
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xed0000
File size:	919'552 bytes
MD5 hash:	AE1078E39C36C64162FA9537C6626FDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000000.00000003.1808662177.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000000.00000003.1808732984.00000000009B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:18:05
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:18:05
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:18:07
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:18:07
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:18:07
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:18:07
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xe50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:18:08
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:18:09
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2f53fb4-f41f-4ad4-bf60-a7c4f431874e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a2ee06d310 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	20:18:11
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4200 -parentBuildID 20230927232528 -prefsHandle 3916 -prefMapHandle 3872 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25cb7036-35d6-4930-967d-0ea6458a771e} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a3003be110 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	20:18:18
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5500 -prefMapHandle 5524 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd47ad4d-ee96-47ae-be13-5a28d62fa25a} 7812 "\\.\pipe\gecko-crash-server-pipe.7812" 1a309888b10 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	1617
Total number of Limit Nodes:	65

Executed Functions

Function 00ED42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00ED430D

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

GetCurrentProcess.KERNEL32(?,00F6CB64,00000000,?,?), ref: 00ED4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00ED4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00ED4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00ED4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00ED4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00ED447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00ED44A0

Strings

|O, xrefs: 00F136F8
kernel32.dll, xrefs: 00ED444F
GetNativeSystemInfo, xrefs: 00ED4460

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 3cd03ceaf0122f5fc882e305d61f22d3c00c4b7822fa8e5a446363e96910b41f
Instruction ID: 00e491065a476b696d574c21639bc5ef53ab61cd30a2a7667c817296d0a8f651
Opcode Fuzzy Hash: 3cd03ceaf0122f5fc882e305d61f22d3c00c4b7822fa8e5a446363e96910b41f
Instruction Fuzzy Hash: 98A191E191A3CCDFCF11CFA9B8401E53EA4BB37344F0A589AD091A7BA2D6704549FB61

Function 00ED42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00ED50AA,?,?,00000000,00000000), ref: 00ED42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00ED50AA,?,?,00000000,00000000), ref: 00ED42C9
LoadResource.KERNEL32(?,00000000,?,?,00ED50AA,?,?,00000000,00000000,?,?,?,?,?,?,00ED4F20), ref: 00F135BE
SizeofResource.KERNEL32(?,00000000,?,?,00ED50AA,?,?,00000000,00000000,?,?,?,?,?,?,00ED4F20), ref: 00F135D3
LockResource.KERNEL32(00ED50AA,?,?,00ED50AA,?,?,00000000,00000000,?,?,?,?,?,?,00ED4F20,?), ref: 00F135E6

Strings

SCRIPT, xrefs: 00ED42BF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 560a92659011197e59ba6df225db8a6d2de5af5706a45dd5c96064ca2bf7b772
Instruction ID: 8af8d8d6ac7de4ef1dcaa0e64b155c408eddf46a2a43ca1fa167bfc0bea35c6b
Opcode Fuzzy Hash: 560a92659011197e59ba6df225db8a6d2de5af5706a45dd5c96064ca2bf7b772
Instruction Fuzzy Hash: 1411CEB0200305BFE7219B65DC48F677BBAEBC5B51F10416AF896D62A0DBB1DC00A6B0

Function 00F12BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00ED2B6B

Part of subcall function 00ED3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00FA1418,?,00ED2E7F,?,?,?,00000000), ref: 00ED3A78

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00F92224), ref: 00F12C10
ShellExecuteW.SHELL32(00000000,?,?,00F92224), ref: 00F12C17

Strings

runas, xrefs: 00F12C0B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 684e2888a7cd10c6c9f8e3bf89ef00ea7e2c9c67af4614237bd685d4ead6c255
Instruction ID: c160ed09f051672fa0c23f4ef41172c90771e8649363398dbe1c9c548e3540d5
Opcode Fuzzy Hash: 684e2888a7cd10c6c9f8e3bf89ef00ea7e2c9c67af4614237bd685d4ead6c255
Instruction Fuzzy Hash: 0611D5312082055AD704FF74DC519BEB7E4EBA6744F04242FF192622A3CF618A4BA713

Function 00F3D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F3D501
Process32FirstW.KERNEL32(00000000,?), ref: 00F3D50F
Process32NextW.KERNEL32(00000000,?), ref: 00F3D52F
CloseHandle.KERNELBASE(00000000), ref: 00F3D5DC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 91dbf82795f65739de46b31714c7584e23a988f12d383eacdeded5c5a82706be
Instruction ID: bee6531d30915fc3867704e3ac46e517b42fff41f1fa964fe0df569900bc711f
Opcode Fuzzy Hash: 91dbf82795f65739de46b31714c7584e23a988f12d383eacdeded5c5a82706be
Instruction Fuzzy Hash: 8331A1721083009FD304EF54DC81AAFBBE8EF99364F14052DF591972A2EB719A45DB92

Function 00F3DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00F15222), ref: 00F3DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00F3DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00F3DBEE
FindClose.KERNEL32(00000000), ref: 00F3DBFA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: f47ec385111873d81f740e11a46a818f080b767212e26765c5cd19df1fd2a92d
Instruction ID: 1249c9c11922e080fa1de46bdfd40c7bf722a0a9f5bbf3a37fc3a6ac7254308a
Opcode Fuzzy Hash: f47ec385111873d81f740e11a46a818f080b767212e26765c5cd19df1fd2a92d
Instruction Fuzzy Hash: 87F0ED718209186782206B7CBC0D8BA77AC9E02374F105702F8F6C20F0EBF09D94E6D6

Function 00EF4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00F028E9,?,00EF4CBE,00F028E9,00F988B8,0000000C,00EF4E15,00F028E9,00000002,00000000,?,00F028E9), ref: 00EF4D09
TerminateProcess.KERNEL32(00000000,?,00EF4CBE,00F028E9,00F988B8,0000000C,00EF4E15,00F028E9,00000002,00000000,?,00F028E9), ref: 00EF4D10
ExitProcess.KERNEL32 ref: 00EF4D22

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0caf00d071689251cf5b030c0adb1461a6de6b156841bffa2a70e3d19a08e14a
Instruction ID: 62b9f682de89c9536fd0e214722692762812aabd684289eeb6a08c61b97a9c3c
Opcode Fuzzy Hash: 0caf00d071689251cf5b030c0adb1461a6de6b156841bffa2a70e3d19a08e14a
Instruction Fuzzy Hash: 34E0B6B100014CABDF11AF54DD0AA6A3F69EB85785B104014FDA59A262DB76DD42EA80

Function 00F5AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00F5B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F5B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F5B1D4
_wcslen.LIBCMT ref: 00F5B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F5B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F5B236
_wcslen.LIBCMT ref: 00F5B332

Part of subcall function 00F405A7: GetStdHandle.KERNEL32(000000F6), ref: 00F405C6

_wcslen.LIBCMT ref: 00F5B34B
_wcslen.LIBCMT ref: 00F5B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F5B3B6
GetLastError.KERNEL32(00000000), ref: 00F5B407
CloseHandle.KERNEL32(?), ref: 00F5B439
CloseHandle.KERNEL32(00000000), ref: 00F5B44A
CloseHandle.KERNEL32(00000000), ref: 00F5B45C
CloseHandle.KERNEL32(00000000), ref: 00F5B46E
CloseHandle.KERNEL32(?), ref: 00F5B4E3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: e0575cfb10aa072042bc0c49dc328ed819a52aadce6dbf777d460ccc63034e1c
Instruction ID: 636014845b5027e986bf4090dfd926e34937bab5010b86cacfc3c11b24b5ef55
Opcode Fuzzy Hash: e0575cfb10aa072042bc0c49dc328ed819a52aadce6dbf777d460ccc63034e1c
Instruction Fuzzy Hash: C3F18D316083409FC724EF24C891B6EBBE5EF85320F14855EF9959B2A2DB31EC45DB92

Function 00EDD730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00EDD807
timeGetTime.WINMM ref: 00EDDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EDDB28
TranslateMessage.USER32(?), ref: 00EDDB7B
DispatchMessageW.USER32(?), ref: 00EDDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EDDB9F
Sleep.KERNELBASE(0000000A), ref: 00EDDBB1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 1654880738434bccf5a3fa6cbf26f3d49154295359368ae42f44665e2de16e95
Instruction ID: 207e62842f14a046884552d59db09e19937d4d48b6288ca42e73567b55d6c46a
Opcode Fuzzy Hash: 1654880738434bccf5a3fa6cbf26f3d49154295359368ae42f44665e2de16e95
Instruction Fuzzy Hash: AA422330608345EFD728CF24CC94BAAB7E0FF86314F14951AE495A7391D7B5E845EB82

Function 00ED2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00ED2D07
RegisterClassExW.USER32(00000030), ref: 00ED2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00ED2D42
InitCommonControlsEx.COMCTL32(?), ref: 00ED2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00ED2D6F
LoadIconW.USER32(000000A9), ref: 00ED2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00ED2D94

Strings

+, xrefs: 00ED2CF0
AutoIt v3 GUI, xrefs: 00ED2D23
TaskbarCreated, xrefs: 00ED2D37
0, xrefs: 00ED2CE9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 47dd2edd4a8c69bb65bc8fe7852d04f9ae87575a4b6376c4ec27e8b9dbec219b
Instruction ID: c5c8e3a241ef32947d380e91c032389df242839fd7f11a771a88117faa567bcb
Opcode Fuzzy Hash: 47dd2edd4a8c69bb65bc8fe7852d04f9ae87575a4b6376c4ec27e8b9dbec219b
Instruction Fuzzy Hash: 3A21F4B590131CAFDB00DFA4EC49BEEBBB8FB09700F00411AF5A1A62A0D7B54544EF91

Function 00F1065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F1039A: CreateFileW.KERNELBASE(00000000,00000000,?,00F10704,?,?,00000000,?,00F10704,00000000,0000000C), ref: 00F103B7

GetLastError.KERNEL32 ref: 00F1076F
__dosmaperr.LIBCMT ref: 00F10776
GetFileType.KERNELBASE(00000000), ref: 00F10782
GetLastError.KERNEL32 ref: 00F1078C
__dosmaperr.LIBCMT ref: 00F10795
CloseHandle.KERNEL32(00000000), ref: 00F107B5
CloseHandle.KERNEL32(?), ref: 00F108FF
GetLastError.KERNEL32 ref: 00F10931
__dosmaperr.LIBCMT ref: 00F10938

Strings

H, xrefs: 00F108BD

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: bf5ae7d5676c55c03b1a017af04aa30116dc26f1cc0522b919d5bde44b0130a4
Instruction ID: 30ec62326357c2735b464c7689ca00a2a3685b12ff0e9b329ee5766997e52f0f
Opcode Fuzzy Hash: bf5ae7d5676c55c03b1a017af04aa30116dc26f1cc0522b919d5bde44b0130a4
Instruction Fuzzy Hash: F1A11632A041088FDF19AF68DC51BEE7BA0EF46320F140159F855AB3D1DB759C92EB91

Function 00ED344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ED3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00FA1418,?,00ED2E7F,?,?,?,00000000), ref: 00ED3A78

Part of subcall function 00ED3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00ED3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00ED356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F1318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F131CE
RegCloseKey.ADVAPI32(?), ref: 00F13210
_wcslen.LIBCMT ref: 00F13277
_wcslen.LIBCMT ref: 00F13286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00ED3560
\, xrefs: 00F1328C
\Include\, xrefs: 00ED3527
Include, xrefs: 00F13184, 00F131C5

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 8598f39741d275744b34153350303bf05dc36254e3f2ca3dc19c9f5ef1cad506
Instruction ID: a4137bda74126e47c7f5ae2e34fe3c4db52471bf934b1cca7435c4aef637ea37
Opcode Fuzzy Hash: 8598f39741d275744b34153350303bf05dc36254e3f2ca3dc19c9f5ef1cad506
Instruction Fuzzy Hash: F871E6B16043049FC744EF69DC419ABBBE8FF87740F40142EF584932A1EB749A49EB52

Function 00ED2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00ED2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00ED2B9D
LoadIconW.USER32(00000063), ref: 00ED2BB3
LoadIconW.USER32(000000A4), ref: 00ED2BC5
LoadIconW.USER32(000000A2), ref: 00ED2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00ED2BEF
RegisterClassExW.USER32(?), ref: 00ED2C40

Part of subcall function 00ED2CD4: GetSysColorBrush.USER32(0000000F), ref: 00ED2D07
Part of subcall function 00ED2CD4: RegisterClassExW.USER32(00000030), ref: 00ED2D31
Part of subcall function 00ED2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00ED2D42
Part of subcall function 00ED2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00ED2D5F
Part of subcall function 00ED2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00ED2D6F
Part of subcall function 00ED2CD4: LoadIconW.USER32(000000A9), ref: 00ED2D85
Part of subcall function 00ED2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00ED2D94

Strings

AutoIt v3, xrefs: 00ED2C2F
0, xrefs: 00ED2C0F
#, xrefs: 00ED2C16

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: bda8a68fd231681fd465f5a5ad3532d20bdecd6ce76c386d2daeb4eda8041c58
Instruction ID: 5a881aafdd05fe3bec2bab2921c3f54809955768ec0fa832f92c02bcf11405e0
Opcode Fuzzy Hash: bda8a68fd231681fd465f5a5ad3532d20bdecd6ce76c386d2daeb4eda8041c58
Instruction Fuzzy Hash: 362129B4E0032CAFDF109FA5EC55AAA7FF8FB49B50F05001AE644A66A0D7F10940EF90

Function 00ED3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00ED316A,?,?), ref: 00ED31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00ED316A,?,?), ref: 00ED3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00ED3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00ED316A,?,?), ref: 00ED3232
CreatePopupMenu.USER32 ref: 00ED3246
PostQuitMessage.USER32(00000000), ref: 00ED3267

Strings

TaskbarCreated, xrefs: 00ED322D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: db882ac473b3cfef45c293664a6a1fa11ffd6bb26f8907f49952c6bafb4fd387
Instruction ID: 28b290a937d1a4f10baaf3091a29a2ae6abfc5a498a4c982acb353257063d01a
Opcode Fuzzy Hash: db882ac473b3cfef45c293664a6a1fa11ffd6bb26f8907f49952c6bafb4fd387
Instruction Fuzzy Hash: 39416B79A00209ABDF141FB8DC19BBA3A59F706354F042127F591A53F2C7B19A42F7A3

Function 00ED1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00ED1459
CoUninitialize.COMBASE ref: 00ED14F8
UnregisterHotKey.USER32(?), ref: 00ED16DD
DestroyWindow.USER32(?), ref: 00F124B9
FreeLibrary.KERNEL32(?), ref: 00F1251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F1254B

Strings

close all, xrefs: 00ED1454

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: aedb317c05206f1ec46fc6da3243de230b6603dc63a7d2eafab8812b1883d0c9
Instruction ID: b8ddf9957aa5afc9dcea200ece9c4323ddff562e7f752f9c4f4b5588fa2dccbb
Opcode Fuzzy Hash: aedb317c05206f1ec46fc6da3243de230b6603dc63a7d2eafab8812b1883d0c9
Instruction Fuzzy Hash: AFD178317012129FCB19EF55C895A69F7A1FF05710F1451AEE48A7B362CB30AD62DF90

Function 00ED2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00ED2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00ED2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00ED1CAD,?), ref: 00ED2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00ED1CAD,?), ref: 00ED2CCF

Strings

AutoIt v3, xrefs: 00ED2C89, 00ED2C8E, 00ED2C8F
edit, xrefs: 00ED2CAC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b752f239e2aba365d7efdf5d34bb03210d0d6664fcb4f1468b801b3603b1714a
Instruction ID: da46b137d82dbfe9c7d08e46bd44e6a830a21fd04f9d693b5bd37a0788389e4f
Opcode Fuzzy Hash: b752f239e2aba365d7efdf5d34bb03210d0d6664fcb4f1468b801b3603b1714a
Instruction Fuzzy Hash: D7F0D0B55403987AEB311B176C08E773E7DE7C7F60F01005AF94093560C6A65850FAB0

Function 00ED3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00ED3B0F,SwapMouseButtons,00000004,?), ref: 00ED3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00ED3B0F,SwapMouseButtons,00000004,?), ref: 00ED3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00ED3B0F,SwapMouseButtons,00000004,?), ref: 00ED3B83

Strings

Control Panel\Mouse, xrefs: 00ED3B3E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: d17665a55fc4710f1e6ae943ca658831537d73147829f6d2dea3ba5943510d51
Instruction ID: 35920966e5ede36dc31b62f969bccb0028282c7ec34538caabf1b758f06e8fb6
Opcode Fuzzy Hash: d17665a55fc4710f1e6ae943ca658831537d73147829f6d2dea3ba5943510d51
Instruction Fuzzy Hash: A7112AB5510208FFDB208FA5DC44AEEBBB9EF04744B10546BE845E7210D2719E41A7A1

Function 00ED3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F133A2

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00ED3A04

Strings

Line: , xrefs: 00F133EB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: b7658c7fe21259e349bbd3acade25927845542229cc3d5e896fa2f7407992236
Instruction ID: 8c5b643ac63578b4b19d3bd0113f4d2773fe0866740e4e1eb557b722fcbadff0
Opcode Fuzzy Hash: b7658c7fe21259e349bbd3acade25927845542229cc3d5e896fa2f7407992236
Instruction Fuzzy Hash: 4D31E571508304AAD724EB20DC45BEB73D8EB85714F00652BF599A2291DB709A4AD7D3

Function 00EEFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00EF0668

Part of subcall function 00EF32A4: RaiseException.KERNEL32(?,?,?,00EF068A,?,00FA1444,?,?,?,?,?,?,00EF068A,00ED1129,00F98738,00ED1129), ref: 00EF3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00EF0685

Strings

Unknown exception, xrefs: 00EF0692

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7fa5326ecc479245e1a746bfe6ab32bf11a9c0a0ccfef49ce52a95c9b9641a71
Instruction ID: 7813f1b3935daeb3e23f7c2eea9a08c68edaec5a612f2806ffafec034ec01ef7
Opcode Fuzzy Hash: 7fa5326ecc479245e1a746bfe6ab32bf11a9c0a0ccfef49ce52a95c9b9641a71
Instruction Fuzzy Hash: 86F0C23490020D778F10BAB5EC46DBE7BAC5E40354B606131FA18F69E3EF71EA26C681

Function 00ED10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00ED1BF4
Part of subcall function 00ED1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00ED1BFC
Part of subcall function 00ED1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00ED1C07
Part of subcall function 00ED1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00ED1C12
Part of subcall function 00ED1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00ED1C1A
Part of subcall function 00ED1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00ED1C22

Part of subcall function 00ED1B4A: RegisterWindowMessageW.USER32(00000004,?,00ED12C4), ref: 00ED1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00ED136A
OleInitialize.OLE32 ref: 00ED1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00F124AB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: f12d5740574f7ef0f97172b5989b0f9f7673a2d0b9772ae36e6639fdbf63358d
Instruction ID: 2e9c35cca7e81863de44a73b2afc23ff67783ed1eaa658eb4d9406a51f689d75
Opcode Fuzzy Hash: f12d5740574f7ef0f97172b5989b0f9f7673a2d0b9772ae36e6639fdbf63358d
Instruction Fuzzy Hash: A971ABF8D112188EC388EF79AD456653BE0FB8B384F1A922AD45AD7362EB344445FF50

Function 00F3C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00ED3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F3C259
KillTimer.USER32(?,00000001,?,?), ref: 00F3C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F3C270

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 4e1818bada5559bb1dad574d75a7ebb025e111636feee46549e71c8c89ebf314
Instruction ID: 98ca0f8dafb94404680100fa74f7219a2bfba50c69e76088f0af10512f23f645
Opcode Fuzzy Hash: 4e1818bada5559bb1dad574d75a7ebb025e111636feee46549e71c8c89ebf314
Instruction Fuzzy Hash: 8D31C571904344AFEB32DF748855BE7BBECAB06314F00049ED2EAA7241C7745A84EB91

Function 00F086AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00F085CC,?,00F98CC8,0000000C), ref: 00F08704
GetLastError.KERNEL32(?,00F085CC,?,00F98CC8,0000000C), ref: 00F0870E
__dosmaperr.LIBCMT ref: 00F08739

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 569334a323e4c01e2633bef8c8768795dce0acbd555c9eae6fcbbdea649670b7
Instruction ID: ac937184b03792d2a00609b4fca7fa2022481aee0a42d6fadc81d7584d368094
Opcode Fuzzy Hash: 569334a323e4c01e2633bef8c8768795dce0acbd555c9eae6fcbbdea649670b7
Instruction Fuzzy Hash: 43014E33E056641AD6246334AC4577F7B4A4B92BF4F3A0119F8989B1D3DEE6CC83B690

Function 00EDDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00EDDB7B
DispatchMessageW.USER32(?), ref: 00EDDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EDDB9F
Sleep.KERNELBASE(0000000A), ref: 00EDDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00F21CC9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: de47a08f8a22359b227ff0c56194100629453b387f3245b05841326e13bbec97
Instruction ID: 639ef241d22202a6caee2a433e8881635eeeb372870da63d33b8c86a8a622449
Opcode Fuzzy Hash: de47a08f8a22359b227ff0c56194100629453b387f3245b05841326e13bbec97
Instruction Fuzzy Hash: B7F082306483889BE734CB70DC49FEA73ACFB45314F10461AE69AD71C0DB749449EB55

Function 00EE1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00EE17F6

Strings

CALL, xrefs: 00EE17C6

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 43d1c4aa237891c4ba8970ba6a25d0a95bba00dce04474f78cd23c73d44eed0d
Instruction ID: 27e1c6fd8adc6dea3f0b1b833000f773c61f9cf0a3d735c86ae7aac25b012273
Opcode Fuzzy Hash: 43d1c4aa237891c4ba8970ba6a25d0a95bba00dce04474f78cd23c73d44eed0d
Instruction Fuzzy Hash: D6229D706083859FC714DF15C880B2ABBF1BF85314F18999DF496AB3A1D731E885DB82

Function 00ED2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00F12C8C

Part of subcall function 00ED3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED3A97,?,?,00ED2E7F,?,?,?,00000000), ref: 00ED3AC2

Part of subcall function 00ED2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00ED2DC4

Strings

X, xrefs: 00F12C5A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 93c233d3e2a57f9787d7cdcb66e0e0ab7c5efbcea6745d5e1ee5718a97dc1b7f
Instruction ID: 8f16961d6a2bc79bb9ddd2832bcfac6a441b5d217da01adbc4799244590072aa
Opcode Fuzzy Hash: 93c233d3e2a57f9787d7cdcb66e0e0ab7c5efbcea6745d5e1ee5718a97dc1b7f
Instruction Fuzzy Hash: 5A218171A002589BDF41EF94C845BEE7BF8EF49314F00805AE545F7341DBB45A8A9BA1

Function 00ED3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00ED3908

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: ecfd0b8b6d3d4c42b50727488ecafc32bd4bd9ad059ebb9cd1fdb0836a242a3d
Instruction ID: c6026e7d1e66eca36e053f470e0669e60600b2dd93b249b327564beb24f31862
Opcode Fuzzy Hash: ecfd0b8b6d3d4c42b50727488ecafc32bd4bd9ad059ebb9cd1fdb0836a242a3d
Instruction Fuzzy Hash: E83180B49043059FD720DF34D88579BBBE4FB49718F00092EF5A9A7390E7B1AA44DB52

Function 00EEF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00EEF661

Part of subcall function 00EDD730: GetInputState.USER32 ref: 00EDD807

Sleep.KERNEL32(00000000), ref: 00F2F2DE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 0a207d7f49aa8e3461dd73178a961c1f0157bc7dbcc716aac69814effeb87b23
Instruction ID: 89ef7aed5d4b1e6c03edfb704d63da2aa26adc334b2d9cd507059995df81759a
Opcode Fuzzy Hash: 0a207d7f49aa8e3461dd73178a961c1f0157bc7dbcc716aac69814effeb87b23
Instruction Fuzzy Hash: BEF0A731240205DFD310EF75E445B6AB7F9FF46760F00002AE899D7361DB70A800CB91

Function 00ED4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00ED4EDD,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4E9C
Part of subcall function 00ED4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00ED4EAE
Part of subcall function 00ED4E90: FreeLibrary.KERNEL32(00000000,?,?,00ED4EDD,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4EFD

Part of subcall function 00ED4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F13CDE,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4E62
Part of subcall function 00ED4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00ED4E74
Part of subcall function 00ED4E59: FreeLibrary.KERNEL32(00000000,?,?,00F13CDE,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4E87

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: b819e5d05b00d15e4ab15436fc6fd7a09fc9d8c1bb1c4fbc0fc4a7b12331b236
Instruction ID: 4175ca03a55af45c397abe26221549e4e004c4541d71944d5a6068baf4ed3100
Opcode Fuzzy Hash: b819e5d05b00d15e4ab15436fc6fd7a09fc9d8c1bb1c4fbc0fc4a7b12331b236
Instruction Fuzzy Hash: 2411E372700205ABCB14AF60DC06FED77E5EF60710F10942FF582BA2E1EE709A46A790

Function 00F08402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F08440

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 6cfd2d44fac543b976c58c0512b3e24e468bb5489b5055c532f5afc232dc50ac
Instruction ID: 424dc775bc38a773b005005ec2e01a2879445bb4f800ede9b60f55b41c5bfa8a
Opcode Fuzzy Hash: 6cfd2d44fac543b976c58c0512b3e24e468bb5489b5055c532f5afc232dc50ac
Instruction Fuzzy Hash: EE11187590410AAFCB05DF58E9419DE7BF5EF48354F104059F808AB352DA31DA12EBA5

Function 00F05000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F04C7D: RtlAllocateHeap.NTDLL(00000008,00ED1129,00000000,?,00F02E29,00000001,00000364,?,?,?,00EFF2DE,00F03863,00FA1444,?,00EEFDF5,?), ref: 00F04CBE

_free.LIBCMT ref: 00F0506C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: cc1b49b7f04f29951b7fb1dbc209fe0a4486a168f5f23f69867e2a81f619ae61
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 030126726047056BE3318E699C85A5AFBECFB89370F65091DE184832C0EA70A805EAB4

Function 00EFE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: f625f919e02dc374723603e98d465f5e489be8b7afcb919c07b0f423b462a72c
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: CCF04932500A1C96C6313E698C05BBA33D88F52334F110715F625F62E1CF78B802A5A5

Function 00F04C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00ED1129,00000000,?,00F02E29,00000001,00000364,?,?,?,00EFF2DE,00F03863,00FA1444,?,00EEFDF5,?), ref: 00F04CBE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fd81241f6f0747b79293885ce13b2ce8abe2234e5563a21d2bf2e64ee2d0610e
Instruction ID: 553b690ecd244ec7071d8acb19f307e2bcb5b36e03a78c094eb67f62ee1bde71
Opcode Fuzzy Hash: fd81241f6f0747b79293885ce13b2ce8abe2234e5563a21d2bf2e64ee2d0610e
Instruction Fuzzy Hash: 62F0BBB2A0222867FB215F629C05B6B37C8BF41770F15C111FA15A61D1CA70F80075E0

Function 00F03820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00FA1444,?,00EEFDF5,?,?,00EDA976,00000010,00FA1440,00ED13FC,?,00ED13C6,?,00ED1129), ref: 00F03852

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 46b049798b2883fa3d242fb048b5d3d12e927b772876eea333c79a2df9b281b0
Instruction ID: 2574cc4712d94eb83b2e6f43e8826c34448352adb68926d7f69481d98ff3f8fe
Opcode Fuzzy Hash: 46b049798b2883fa3d242fb048b5d3d12e927b772876eea333c79a2df9b281b0
Instruction Fuzzy Hash: A0E02B3390022857EB312A779C00BAB37CCAF437B0F0A81A0FD55A64D1CB21DE01B1E0

Function 00ED4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4F6D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 58fff76834afb2e70af767bcb84b75ecd202a83ee470d162fdc33ef4b4a3f6b0
Instruction ID: 6822409b116a8c98435585aaada62bb5c50728f4d1643af269b96315d651e41e
Opcode Fuzzy Hash: 58fff76834afb2e70af767bcb84b75ecd202a83ee470d162fdc33ef4b4a3f6b0
Instruction Fuzzy Hash: FEF01CB1205755CFDB349F64D490862BBE4FF24319310A96FE1EAA2661C7319845DB50

Function 00F62A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00F62A66

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 1d393a0a0c4dfd29a45f86d05cedde247f805d6a32fb9338635c00319a69ffbc
Instruction ID: 8e6d10a421e7f75ebf343ba08a78ddd33cba40fc52cd8527604bd46f6b14f3a1
Opcode Fuzzy Hash: 1d393a0a0c4dfd29a45f86d05cedde247f805d6a32fb9338635c00319a69ffbc
Instruction Fuzzy Hash: 58E02636750516AAC750EB70DC809FE775CEF103A0B000536FC2AC2100DF7CA991B2E0

Function 00ED30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00ED314E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 19fe1cebd552af3511bac8ca515b241abf7972340bdbd6114c11a9fe632acd59
Instruction ID: bdbbb8933e4c39621a9f3b96ad5cd995d7b9eb834f0083c88daa473b222165f2
Opcode Fuzzy Hash: 19fe1cebd552af3511bac8ca515b241abf7972340bdbd6114c11a9fe632acd59
Instruction Fuzzy Hash: 0CF012B09143589FEB52DF24DC457967ABCB701708F0001E9A698A6291DBB45788CB51

Function 00ED2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00ED2DC4

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: dd4ecf0022001e6c28ac143df7695545873c20d86617a7af59cf09c5fd28357d
Instruction ID: a01ca89c44b58bb9673c3db0d5f4c85dd0cebaa84d69365ec24ab2d06b53bf26
Opcode Fuzzy Hash: dd4ecf0022001e6c28ac143df7695545873c20d86617a7af59cf09c5fd28357d
Instruction Fuzzy Hash: 0AE0CD726041245BC710A2589C05FEA77DDDFC8790F050072FD49E7248D964AD818590

Function 00ED2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ED3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00ED3908

Part of subcall function 00EDD730: GetInputState.USER32 ref: 00EDD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00ED2B6B

Part of subcall function 00ED30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00ED314E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: ad24097306f56ae216de47a6515a78de71d5a0c306b89662652eea0e66b83e86
Instruction ID: 9b90211daf93848637a4e1c615da02674d861a5a820813bdc8a5373ab2a6765b
Opcode Fuzzy Hash: ad24097306f56ae216de47a6515a78de71d5a0c306b89662652eea0e66b83e86
Instruction Fuzzy Hash: B5E0262530420802C608BB34AC1247DB7C9DBD7351F00343FF182A33A3CE6449475252

Function 00F1039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00F10704,?,?,00000000,?,00F10704,00000000,0000000C), ref: 00F103B7

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f5f597c94d64ed86dec790e0bf43e6e11c5272b878521d46e8eeb4b07dfced82
Instruction ID: d7bd6cf491cfb52681c7c0db993bd9af4dd2a4a49e6b80b0f43dbd18c7a1a71f
Opcode Fuzzy Hash: f5f597c94d64ed86dec790e0bf43e6e11c5272b878521d46e8eeb4b07dfced82
Instruction Fuzzy Hash: 39D06C3204010DBBDF028F84DD06EDA3BAAFB48714F014100FE5856020C772E821AB90

Function 00ED1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00ED1CBC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 5e89ab1e56213334519c2da430345352695fed7da87820fdc42335a722571e83
Instruction ID: d5ab5a1d2b36b91077655f1583546087d558803c5ba1d9dc9b9ecd915d2a3551
Opcode Fuzzy Hash: 5e89ab1e56213334519c2da430345352695fed7da87820fdc42335a722571e83
Instruction Fuzzy Hash: 5CC09B7538030C9FF6144B84BC4AF107754B349B10F084001F659555E3C7E11810FA90

Non-executed Functions

Function 00F69576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00F6961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F6965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00F6969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F696C9
SendMessageW.USER32 ref: 00F696F2
GetKeyState.USER32(00000011), ref: 00F6978B
GetKeyState.USER32(00000009), ref: 00F69798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F697AE
GetKeyState.USER32(00000010), ref: 00F697B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F697E9
SendMessageW.USER32 ref: 00F69810
SendMessageW.USER32(?,00001030,?,00F67E95), ref: 00F69918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00F6992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F69941
SetCapture.USER32(?), ref: 00F6994A
ClientToScreen.USER32(?,?), ref: 00F699AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F699BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F699D6
ReleaseCapture.USER32 ref: 00F699E1
GetCursorPos.USER32(?), ref: 00F69A19
ScreenToClient.USER32(?,?), ref: 00F69A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F69A80
SendMessageW.USER32 ref: 00F69AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F69AEB
SendMessageW.USER32 ref: 00F69B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F69B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F69B4A
GetCursorPos.USER32(?), ref: 00F69B68
ScreenToClient.USER32(?,?), ref: 00F69B75
GetParent.USER32(?), ref: 00F69B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F69BFA
SendMessageW.USER32 ref: 00F69C2B
ClientToScreen.USER32(?,?), ref: 00F69C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F69CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F69CDE
SendMessageW.USER32 ref: 00F69D01
ClientToScreen.USER32(?,?), ref: 00F69D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F69D82

Part of subcall function 00EE9944: GetWindowLongW.USER32(?,000000EB), ref: 00EE9952

GetWindowLongW.USER32(?,000000F0), ref: 00F69E05

Strings

@GUI_DRAGID, xrefs: 00F6997D
F, xrefs: 00F69D07

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: bb3d63dc8e3bf732e4ff39423826ffb2421cd04b60a32e9ffb292a482663837f
Instruction ID: c253acd35ecbce4af3101d34ff25806f4611a6c76f7a82770662fbdb80e87361
Opcode Fuzzy Hash: bb3d63dc8e3bf732e4ff39423826ffb2421cd04b60a32e9ffb292a482663837f
Instruction Fuzzy Hash: 9642A075608305AFD724CF28CC44AAABBE9FF49320F14061DF5A9972A1D7B2D850EF91

Function 00F64873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00F648F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00F64908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00F64927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00F6494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00F6495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00F6497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00F649AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00F649D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00F64A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00F64A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00F64A7E
IsMenu.USER32(?), ref: 00F64A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F64AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F64B20
GetWindowLongW.USER32(?,000000F0), ref: 00F64B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00F64BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00F64C82
wsprintfW.USER32 ref: 00F64CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F64CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00F64CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F64D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F64D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00F64D5A

Strings

%d/%02d/%02d, xrefs: 00F64CA8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: c514dd190fd0d41fd9779ea695a6b32c26dd2251afc6e85e45ce58072a1b95ed
Instruction ID: 04afc74a1814f7377557862794592c77dd5e0a9595ff2aa08fcd931daee1a37c
Opcode Fuzzy Hash: c514dd190fd0d41fd9779ea695a6b32c26dd2251afc6e85e45ce58072a1b95ed
Instruction Fuzzy Hash: 97122471900248ABEB24AF24DC49FBE7BF8EF45720F104119F565EB2E1DBB4A941EB50

Function 00EEF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00EEF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F2F474
IsIconic.USER32(00000000), ref: 00F2F47D
ShowWindow.USER32(00000000,00000009), ref: 00F2F48A
SetForegroundWindow.USER32(00000000), ref: 00F2F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F2F4AA
GetCurrentThreadId.KERNEL32 ref: 00F2F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F2F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F2F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F2F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00F2F4DE
SetForegroundWindow.USER32(00000000), ref: 00F2F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F2F4F6
keybd_event.USER32(00000012,00000000), ref: 00F2F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F2F50B
keybd_event.USER32(00000012,00000000), ref: 00F2F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F2F519
keybd_event.USER32(00000012,00000000), ref: 00F2F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F2F528
keybd_event.USER32(00000012,00000000), ref: 00F2F52D
SetForegroundWindow.USER32(00000000), ref: 00F2F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00F2F557

Strings

Shell_TrayWnd, xrefs: 00F2F46F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: ac1bc0a9892532a56ea8e30ccdbf005044f3abe9192b1897d5a2b9326a49a335
Instruction ID: c8ec75ae63c213d35749b1cd200452f24548a8acaeb4abcefb8e1ef6537e5982
Opcode Fuzzy Hash: ac1bc0a9892532a56ea8e30ccdbf005044f3abe9192b1897d5a2b9326a49a335
Instruction Fuzzy Hash: 5A316171A5022CBBEB206BB59C4AFBF7E7CEB44B50F140026FA55E61D1C6F15D00BAA1

Function 00F31201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00F316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F3170D
Part of subcall function 00F316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F3173A
Part of subcall function 00F316C3: GetLastError.KERNEL32 ref: 00F3174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00F31286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00F312A8
CloseHandle.KERNEL32(?), ref: 00F312B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F312D1
GetProcessWindowStation.USER32 ref: 00F312EA
SetProcessWindowStation.USER32(00000000), ref: 00F312F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F31310

Part of subcall function 00F310BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F311FC), ref: 00F310D4
Part of subcall function 00F310BF: CloseHandle.KERNEL32(?,?,00F311FC), ref: 00F310E9

Strings

default, xrefs: 00F3130B
, xrefs: 00F3125A
winsta0, xrefs: 00F312CC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 06df1f266ba4f07d0a852219a95ada6054598ce28d452147bdebd362ef8f0fea
Instruction ID: 2dde216cf817d350fa886bd48f5d487bcb3cf455ace3f7f8b8b72249fbc4af1f
Opcode Fuzzy Hash: 06df1f266ba4f07d0a852219a95ada6054598ce28d452147bdebd362ef8f0fea
Instruction Fuzzy Hash: 95818971900209ABDF21DFA4DC49BFE7BB9FF05720F144129FA61A62A0CB758954EB60

Function 00F30B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F31114
Part of subcall function 00F310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F31120
Part of subcall function 00F310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F3112F
Part of subcall function 00F310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F31136
Part of subcall function 00F310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F3114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F30BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F30C00
GetLengthSid.ADVAPI32(?), ref: 00F30C17
GetAce.ADVAPI32(?,00000000,?), ref: 00F30C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F30C6D
GetLengthSid.ADVAPI32(?), ref: 00F30C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F30C8C
HeapAlloc.KERNEL32(00000000), ref: 00F30C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F30CB4
CopySid.ADVAPI32(00000000), ref: 00F30CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F30CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F30D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F30D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F30D45
HeapFree.KERNEL32(00000000), ref: 00F30D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F30D55
HeapFree.KERNEL32(00000000), ref: 00F30D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F30D65
HeapFree.KERNEL32(00000000), ref: 00F30D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00F30D78
HeapFree.KERNEL32(00000000), ref: 00F30D7F

Part of subcall function 00F31193: GetProcessHeap.KERNEL32(00000008,00F30BB1,?,00000000,?,00F30BB1,?), ref: 00F311A1
Part of subcall function 00F31193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F30BB1,?), ref: 00F311A8
Part of subcall function 00F31193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F30BB1,?), ref: 00F311B7

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 6d9ebe83db77d4bceb9ea8380ecd2fad7a5207ff0bef3b20d0b4ab788449a38b
Instruction ID: de9bf75b9ba808494629246c459ec5b7d5212c06b0b8650efea98895c6fc66ce
Opcode Fuzzy Hash: 6d9ebe83db77d4bceb9ea8380ecd2fad7a5207ff0bef3b20d0b4ab788449a38b
Instruction Fuzzy Hash: 5F715B72D0020ABBDF10DFA5DC44FAEBBB8BF05320F044556E954E7191DBB5A905EBA0

Function 00F4EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00F6CC08), ref: 00F4EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00F4EB37
GetClipboardData.USER32(0000000D), ref: 00F4EB43
CloseClipboard.USER32 ref: 00F4EB4F
GlobalLock.KERNEL32(00000000), ref: 00F4EB87
CloseClipboard.USER32 ref: 00F4EB91
GlobalUnlock.KERNEL32(00000000), ref: 00F4EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00F4EBC9
GetClipboardData.USER32(00000001), ref: 00F4EBD1
GlobalLock.KERNEL32(00000000), ref: 00F4EBE2
GlobalUnlock.KERNEL32(00000000), ref: 00F4EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00F4EC38
GetClipboardData.USER32(0000000F), ref: 00F4EC44
GlobalLock.KERNEL32(00000000), ref: 00F4EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00F4EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00F4EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00F4ECD2
GlobalUnlock.KERNEL32(00000000), ref: 00F4ECF3
CountClipboardFormats.USER32 ref: 00F4ED14
CloseClipboard.USER32 ref: 00F4ED59

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 5a0e42a4947b6800ef7b41588d9b099b1f5aac03525cc5f9c23c968928ae7a8e
Instruction ID: af09f56170649d40dc049f1819f6e89c2de891cd241c719e75564b0ecb00d313
Opcode Fuzzy Hash: 5a0e42a4947b6800ef7b41588d9b099b1f5aac03525cc5f9c23c968928ae7a8e
Instruction Fuzzy Hash: 0361AD356042059FD300EF24D894F3ABBE4FF84714F14551EF8A6972A2CB71E946EBA2

Function 00F4698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F469BE
FindClose.KERNEL32(00000000), ref: 00F46A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F46A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F46A75

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00F46AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00F46ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00F46B32
%02d, xrefs: 00F46C00, 00F46C0A, 00F46C5A, 00F46CAA, 00F46CFA, 00F46D4A
%03d, xrefs: 00F46DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00F46B6A
%4d, xrefs: 00F46BB1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: a82fed52af8dd731f04854ed0262088804980460c180fefcc72554de2e1ed5e8
Instruction ID: 5c329f56e6092732ab65858d91d43d93ce37f606a151afd2df84d036a7d7b74a
Opcode Fuzzy Hash: a82fed52af8dd731f04854ed0262088804980460c180fefcc72554de2e1ed5e8
Instruction Fuzzy Hash: 98D16072508340AEC714EBA0CC91EABB7ECEF88704F44591EF985D7291EB74DA05CB62

Function 00F49642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F49663
GetFileAttributesW.KERNEL32(?), ref: 00F496A1
SetFileAttributesW.KERNEL32(?,?), ref: 00F496BB
FindNextFileW.KERNEL32(00000000,?), ref: 00F496D3
FindClose.KERNEL32(00000000), ref: 00F496DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00F496FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00F4974A
SetCurrentDirectoryW.KERNEL32(00F96B7C), ref: 00F49768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F49772
FindClose.KERNEL32(00000000), ref: 00F4977F
FindClose.KERNEL32(00000000), ref: 00F4978F

Strings

*.*, xrefs: 00F496F5

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 14ed6efcf0932d1e37208c0b5aa3c8e10c28bca5aa4eb3d74b7b6b9ab093ac32
Instruction ID: b3c5447aec213aa1bb10fe0235662635a2980bd2bac747c8849c9fc8c49eb796
Opcode Fuzzy Hash: 14ed6efcf0932d1e37208c0b5aa3c8e10c28bca5aa4eb3d74b7b6b9ab093ac32
Instruction Fuzzy Hash: 6F31B032B0421D6ADF10EFB4DC09AEF7BAC9F49320F104156EDA5E21A0EBB0DD40AB54

Function 00F4979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F497BE
FindNextFileW.KERNEL32(00000000,?), ref: 00F49819
FindClose.KERNEL32(00000000), ref: 00F49824
FindFirstFileW.KERNEL32(*.*,?), ref: 00F49840
SetCurrentDirectoryW.KERNEL32(?), ref: 00F49890
SetCurrentDirectoryW.KERNEL32(00F96B7C), ref: 00F498AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F498B8
FindClose.KERNEL32(00000000), ref: 00F498C5
FindClose.KERNEL32(00000000), ref: 00F498D5

Part of subcall function 00F3DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F3DB00

Strings

*.*, xrefs: 00F4983B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 0f65349d6c1880ac6a901d4684ee69491a8ed12751bb942a361eec3e2a469379
Instruction ID: e06d942e0271081db6d47ed63865d5ae96b87d6999549dff21dc0c0b1136d34b
Opcode Fuzzy Hash: 0f65349d6c1880ac6a901d4684ee69491a8ed12751bb942a361eec3e2a469379
Instruction Fuzzy Hash: C231B332A0421D6AEF10EFA8DC49AEF7BAC9F46330F504155ED90E21A1DBB0D944EB60

Function 00F5BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F5B6AE,?,?), ref: 00F5C9B5
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5C9F1
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA68
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F5BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00F5BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00F5BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F5C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F5C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00F5C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00F5C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00F5C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00F5C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F5C382
RegCloseKey.ADVAPI32(00000000), ref: 00F5C38F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: d2fad078bb87be3a41128aeeafee214e0f228f5b88325760bcf3f119940a0459
Instruction ID: 0874d96cc81f356935c606345a506dd66fa40e3a15c309cbcd53721530363380
Opcode Fuzzy Hash: d2fad078bb87be3a41128aeeafee214e0f228f5b88325760bcf3f119940a0459
Instruction Fuzzy Hash: 89025F71604300AFC714DF24C895E2ABBE5EF89314F18849DF98ADB2A2D731ED46DB91

Function 00F48195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F48257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00F48267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F48273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F48310
SetCurrentDirectoryW.KERNEL32(?), ref: 00F48324
SetCurrentDirectoryW.KERNEL32(?), ref: 00F48356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00F4838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00F48395

Strings

*.*, xrefs: 00F4839B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 1214da62fc491ea9794f5f45ef6aa2af0e2ae96cf8399ac54b374c788bc868fa
Instruction ID: 03b9f8b15804368cb9ac430c743fe3e3176ceb9ca35d681bb87b942aa9326f4f
Opcode Fuzzy Hash: 1214da62fc491ea9794f5f45ef6aa2af0e2ae96cf8399ac54b374c788bc868fa
Instruction Fuzzy Hash: 4A619B725043059FCB10EF60C8409AEB7E8FF89360F04891EF999D7251EB35E906DB92

Function 00F3D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED3A97,?,?,00ED2E7F,?,?,?,00000000), ref: 00ED3AC2

Part of subcall function 00F3E199: GetFileAttributesW.KERNEL32(?,00F3CF95), ref: 00F3E19A

FindFirstFileW.KERNEL32(?,?), ref: 00F3D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00F3D1DD
MoveFileW.KERNEL32(?,?), ref: 00F3D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F3D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F3D237

Part of subcall function 00F3D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00F3D21C,?,?), ref: 00F3D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00F3D253
FindClose.KERNEL32(00000000), ref: 00F3D264

Strings

\*.*, xrefs: 00F3D0CD, 00F3D0D6, 00F3D0EB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 418d4de9236b7f578e0bcca057ce9a9045496812f5f126689b8b237e6665bea2
Instruction ID: d0ff024fc6a58a8a4addd58000af69edab18c5a974b0f1e98a231c24580f57de
Opcode Fuzzy Hash: 418d4de9236b7f578e0bcca057ce9a9045496812f5f126689b8b237e6665bea2
Instruction Fuzzy Hash: A1618D31D0110D9BCF05EBA0EE929EEB7B5EF55310F244066E44177292EB349F0AEB61

Function 00F4ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00F4ED91
EmptyClipboard.USER32 ref: 00F4ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00F4EDAC
CloseClipboard.USER32 ref: 00F4EEA3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 42514a2f18123dc22c9a9ba7f6701b32e40093c562fa6ed0d69ad4f02f2481b3
Instruction ID: f141ff6d1ddd79fb0f830472c0b6319c94b628fc8c258f4a7335ac3098549c7e
Opcode Fuzzy Hash: 42514a2f18123dc22c9a9ba7f6701b32e40093c562fa6ed0d69ad4f02f2481b3
Instruction Fuzzy Hash: D841AE35A04611AFD710DF15D888B69BBE1FF44328F15C099E8A98B762C776EC42DBD0

Function 00F3E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F3170D
Part of subcall function 00F316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F3173A
Part of subcall function 00F316C3: GetLastError.KERNEL32 ref: 00F3174A

ExitWindowsEx.USER32(?,00000000), ref: 00F3E932

Strings

@, xrefs: 00F3E925
, xrefs: 00F3E920
, xrefs: 00F3E95C
SeShutdownPrivilege, xrefs: 00F3E902

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 04f743defd9968c00dc5131269eb0bc7a6249437767a983ecf739888a16995a5
Instruction ID: 9550a2b6740f11c68128d61bfde7ab581471422a6934b289aa22029aceca39ed
Opcode Fuzzy Hash: 04f743defd9968c00dc5131269eb0bc7a6249437767a983ecf739888a16995a5
Instruction Fuzzy Hash: C301D673A12215ABEB6426B49C86BBB725CAF14770F154422FD53E21D1D5A49C40B3D0

Function 00F51204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F51276
WSAGetLastError.WSOCK32 ref: 00F51283
bind.WSOCK32(00000000,?,00000010), ref: 00F512BA
WSAGetLastError.WSOCK32 ref: 00F512C5
closesocket.WSOCK32(00000000), ref: 00F512F4
listen.WSOCK32(00000000,00000005), ref: 00F51303
WSAGetLastError.WSOCK32 ref: 00F5130D
closesocket.WSOCK32(00000000), ref: 00F5133C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 9739ca5a84622ac5085a9b3737e60d4e571227d6b65b26b833806d0e4f004f64
Instruction ID: e4a7b10a9bfff5c8b62a8dda5b54819393d64c70b3aba1c00b98dedbbe635004
Opcode Fuzzy Hash: 9739ca5a84622ac5085a9b3737e60d4e571227d6b65b26b833806d0e4f004f64
Instruction Fuzzy Hash: A0419131A001019FD720DF24C484B29BBE5BF86329F188189D9969F292C775FC86DBE1

Function 00F3D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED3A97,?,?,00ED2E7F,?,?,?,00000000), ref: 00ED3AC2

Part of subcall function 00F3E199: GetFileAttributesW.KERNEL32(?,00F3CF95), ref: 00F3E19A

FindFirstFileW.KERNEL32(?,?), ref: 00F3D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F3D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F3D481
FindClose.KERNEL32(00000000), ref: 00F3D498
FindClose.KERNEL32(00000000), ref: 00F3D4A1

Strings

\*.*, xrefs: 00F3D3F2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 6a9d9d57455417b696aec2a2a1e0eff5a3330042d5be742cbb07eed20a3937be
Instruction ID: f3e9a71337e8d80eb6b07885a9558b0800cb6a7bb9ac89fa3b8a702bc7f60738
Opcode Fuzzy Hash: 6a9d9d57455417b696aec2a2a1e0eff5a3330042d5be742cbb07eed20a3937be
Instruction Fuzzy Hash: 303164714083459BC305EF64D8518AF77E8EE91324F44592EF4E193291EB30AA0AE763

Function 00F0E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F0E645

Strings

1#QNAN, xrefs: 00F0F84B
1#IND, xrefs: 00F0F83D
1#INF, xrefs: 00F0F852
1#SNAN, xrefs: 00F0F844

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 5f78d8e42be23ee93d24b2479a346ebd1506d589cae5735562f47b207b85a34f
Instruction ID: a1a4bcbbeeb9d41add6420ca4ceb6cac7c8e4dffbe8c624721dcbe61fab681ed
Opcode Fuzzy Hash: 5f78d8e42be23ee93d24b2479a346ebd1506d589cae5735562f47b207b85a34f
Instruction Fuzzy Hash: 12C24D72E046298FDB35CE28DD407EAB7B5EB48314F1445EAD84DE7280E774AE85AF40

Function 00F4648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F464DC
CoInitialize.OLE32(00000000), ref: 00F46639
CoCreateInstance.OLE32(00F6FCF8,00000000,00000001,00F6FB68,?), ref: 00F46650
CoUninitialize.OLE32 ref: 00F468D4

Strings

.lnk, xrefs: 00F464BA, 00F46524, 00F465E0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 92946714e012cb64efd40ba946cb9a9110eecc46935ce38c22abbc8b61b323ab
Instruction ID: 19c302408c4200ff657ad144f8180945fe9cace6b5e056a83dc13648460f389a
Opcode Fuzzy Hash: 92946714e012cb64efd40ba946cb9a9110eecc46935ce38c22abbc8b61b323ab
Instruction Fuzzy Hash: 08D149716082019FC304EF24C88196BBBE8FF99704F14496EF595DB292EB70ED06CB92

Function 00F522DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00F522E8

Part of subcall function 00F4E4EC: GetWindowRect.USER32(?,?), ref: 00F4E504

GetDesktopWindow.USER32 ref: 00F52312
GetWindowRect.USER32(00000000), ref: 00F52319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00F52355
GetCursorPos.USER32(?), ref: 00F52381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F523DF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: c654f7c5a9a4b8a057af13095fc13d6f3e1182417227112cd0299346380bf4d4
Instruction ID: 8ee3b07138b6ebf8356b57da7597b1b2fcba894ddb10886e16fc1cc49a42ecd1
Opcode Fuzzy Hash: c654f7c5a9a4b8a057af13095fc13d6f3e1182417227112cd0299346380bf4d4
Instruction Fuzzy Hash: E631ED72504309ABD720DF54CC48B6BBBA9FF85320F000A19FA9597191DB74EA08DBD2

Function 00F49B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00F49B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00F49C8B

Part of subcall function 00F43874: GetInputState.USER32 ref: 00F438CB
Part of subcall function 00F43874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F43966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00F49BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00F49C75

Strings

*.*, xrefs: 00F49B5D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: d064faf1bf23dc930d69e175c9438026a5c0114d567129e574fb0d4f6641ff95
Instruction ID: f8524bcb7d3a7ba8dad3083c3045f59747f66b720656dfbcc2c906f9316cf17b
Opcode Fuzzy Hash: d064faf1bf23dc930d69e175c9438026a5c0114d567129e574fb0d4f6641ff95
Instruction Fuzzy Hash: BA41B271E0420A9FCF14DF64CC85AEEBBF4EF45310F204056E955A2291EB709E45EFA1

Function 00EE997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00EE9A4E
GetSysColor.USER32(0000000F), ref: 00EE9B23
SetBkColor.GDI32(?,00000000), ref: 00EE9B36

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 492dbda806f2ff5b5bf998632253c2e23532196a2bf3289a3b5f700e25ed7ac3
Instruction ID: 832de1faef8c07c83eb29c9a7240ffe34aec12a0d38b5d0c349d953e473b6a08
Opcode Fuzzy Hash: 492dbda806f2ff5b5bf998632253c2e23532196a2bf3289a3b5f700e25ed7ac3
Instruction Fuzzy Hash: A4A15B705086ACBEE724AA3E9C58EBB3ADDEF42314F151119F402E7693CB259D01F276

Function 00F51806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00F5307A
Part of subcall function 00F5304E: _wcslen.LIBCMT ref: 00F5309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00F5185D
WSAGetLastError.WSOCK32 ref: 00F51884
bind.WSOCK32(00000000,?,00000010), ref: 00F518DB
WSAGetLastError.WSOCK32 ref: 00F518E6
closesocket.WSOCK32(00000000), ref: 00F51915

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: a57d1a56c9ef7964cfc53db8e9759ebe3db670c41669214e91d35e93d45743f1
Instruction ID: 4767b62b1f332b1884c807a686dbac0f9854c4f717cd624e543202d0c54d3aab
Opcode Fuzzy Hash: a57d1a56c9ef7964cfc53db8e9759ebe3db670c41669214e91d35e93d45743f1
Instruction Fuzzy Hash: BD510471A00200AFDB20AF24C886F6A77E5EB44719F189058FA55AF3C3C770AD42CBE1

Function 00F61C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00F61CC0
IsWindowEnabled.USER32 ref: 00F61CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00F61CDB
IsIconic.USER32 ref: 00F61CE9
IsZoomed.USER32 ref: 00F61CF7

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 14e7d0fbfcad788e0f00df837e960a10787d695a4f292935b0c2eea6f17e8482
Instruction ID: 5349970a1e1452bd2c5398816cd644b4e289e334ab585d961b1e4f2ae5e3717d
Opcode Fuzzy Hash: 14e7d0fbfcad788e0f00df837e960a10787d695a4f292935b0c2eea6f17e8482
Instruction Fuzzy Hash: A021A331B406115FD7209F1AC884BAA7BE5FF95325B1D8059E88ACB351CBB5DC42EB90

Function 00ED8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00ED83E8
VUUU, xrefs: 00F15DF0
VUUU, xrefs: 00ED843C
ERCP, xrefs: 00ED813C
VUUU, xrefs: 00ED83FA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 751a3279f077c06c2c919966a0e61431c516d8126ea493bd4cdb090ac71b9455
Instruction ID: 9feb3a93b2a202ac5642a619a8b99c7052150bea335eec77392db6f12ea65044
Opcode Fuzzy Hash: 751a3279f077c06c2c919966a0e61431c516d8126ea493bd4cdb090ac71b9455
Instruction Fuzzy Hash: CCA24A71E0021ACBDF24CF58C9407EEB7B1EB94724F2491AAE815A7385DB749DC2DB90

Function 00F3AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00F3AAAC
SetKeyboardState.USER32(00000080), ref: 00F3AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00F3AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00F3AB88

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f711ab4c8836d51f54d1964a4a3f6edf50d4ff8cbfd31801c4f6a3f9631de527
Instruction ID: cc2f040891acc6d38474be7e905ecbf7e8661832b6f279845098ad594f7dad6e
Opcode Fuzzy Hash: f711ab4c8836d51f54d1964a4a3f6edf50d4ff8cbfd31801c4f6a3f9631de527
Instruction Fuzzy Hash: 41311831E40648AEFF35CB66CC05BFABBA6AB84330F04421AF1D5561D1D3B58981E7A2

Function 00F0BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F0BB7F

Part of subcall function 00F029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000), ref: 00F029DE
Part of subcall function 00F029C8: GetLastError.KERNEL32(00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000,00000000), ref: 00F029F0

GetTimeZoneInformation.KERNEL32 ref: 00F0BB91
WideCharToMultiByte.KERNEL32(00000000,?,00FA121C,000000FF,?,0000003F,?,?), ref: 00F0BC09
WideCharToMultiByte.KERNEL32(00000000,?,00FA1270,000000FF,?,0000003F,?,?,?,00FA121C,000000FF,?,0000003F,?,?), ref: 00F0BC36

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: ba8b10d88945af9f9e09a35df645990da9abc874ded62ff22990603fbee016d1
Instruction ID: 6c138b99ade40f8ce70ea29a141d14fe247de13bf07ee079d07d2e735f5a77ee
Opcode Fuzzy Hash: ba8b10d88945af9f9e09a35df645990da9abc874ded62ff22990603fbee016d1
Instruction Fuzzy Hash: FD31AFB1904249DFDB11DF69CC81A69BBF8FF46360B1586AAE060D72E1D7309D40FB50

Function 00F4CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00F4CE89
GetLastError.KERNEL32(?,00000000), ref: 00F4CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00F4CEFE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: a5dfaf3f3707376f63b48f2bb7caaeeced154a0f5e8a16278f8d8fde21c8a62c
Instruction ID: 295ce7a3f3b2def96589569669cc4a90e47ee0345c66649407f8f312b32f1092
Opcode Fuzzy Hash: a5dfaf3f3707376f63b48f2bb7caaeeced154a0f5e8a16278f8d8fde21c8a62c
Instruction Fuzzy Hash: B521A1719013099BD760DF65C944BA77BFCEB40364F10541EEA86E2151E774EE04ABA0

Function 00F38298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F382AA

Strings

|, xrefs: 00F382DA
(, xrefs: 00F382F0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: b230859d74cbf7c3ce97e64c66acc8c078078c1de5bd10ac73d1169dd97ec6a6
Instruction ID: 6881395d064329c80f686215c9a4d562f7157a7e32b1c106b25e7a1d46c58819
Opcode Fuzzy Hash: b230859d74cbf7c3ce97e64c66acc8c078078c1de5bd10ac73d1169dd97ec6a6
Instruction Fuzzy Hash: 31323575A007059FCB28CF59C481A6AB7F0FF48760F15856EE49ADB3A1EB74E942CB40

Function 00F45C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F45CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00F45D17
FindClose.KERNEL32(?), ref: 00F45D5F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7ed8015c30c7456ae0194b3d33a78b01ce267b382f4db7ccbea44945c23a06f5
Instruction ID: 19985fd236398ffc8da7e598c76f040dfd55902cc393a56373c6b4753e4858b3
Opcode Fuzzy Hash: 7ed8015c30c7456ae0194b3d33a78b01ce267b382f4db7ccbea44945c23a06f5
Instruction Fuzzy Hash: 93519C35A046019FC714DF28C494A9ABBF4FF49324F14855EE99A8B3A2DB30ED05DB91

Function 00F02622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00F0271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F02724
UnhandledExceptionFilter.KERNEL32(?), ref: 00F02731

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 49cbd9a1ae2b67a9b8e6706f9ae412dc2116c4d956277884a6518e7996044cbd
Instruction ID: 583abfb90bea3c4164305215223a5b476a95bad2a5479337fc49212f562bbf44
Opcode Fuzzy Hash: 49cbd9a1ae2b67a9b8e6706f9ae412dc2116c4d956277884a6518e7996044cbd
Instruction Fuzzy Hash: EF31C47491121C9BCB21DF64DC89798B7B8BF08310F5041EAE91CA6261E7709F819F54

Function 00F451CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F451DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F45238
SetErrorMode.KERNEL32(00000000), ref: 00F452A1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: b9b414a955d0ea4418976dab4ed6fad262f817eab611a8071e619c0b3113f076
Instruction ID: 7fac5f80787a4324f6130929d79918894f5f607a9b094c027fc1448281973a47
Opcode Fuzzy Hash: b9b414a955d0ea4418976dab4ed6fad262f817eab611a8071e619c0b3113f076
Instruction Fuzzy Hash: 1B318035A00508DFDB00DF54D884EADBBF4FF09318F08809AE845AB352DB71E946CB90

Function 00F316C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00EEFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00EF0668
Part of subcall function 00EEFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00EF0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F3170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F3173A
GetLastError.KERNEL32 ref: 00F3174A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: ea7d0537121ba480aae333f1991134e867a02c6142b9066afcc3141931fb0d7d
Instruction ID: 743b8556b32be6467be9e1e6ee25a23542557b299ec9a935bbe590ed90b5244b
Opcode Fuzzy Hash: ea7d0537121ba480aae333f1991134e867a02c6142b9066afcc3141931fb0d7d
Instruction Fuzzy Hash: 2A11C1B2404309BFD718AF54DC86E6ABBFDFB04764B24852EE09693241EB70BC418A60

Function 00F3D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F3D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00F3D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F3D650

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 0e29ab10ff8567d919b78903a6a782e911053938b663a8a038d2bb152009cb07
Instruction ID: 44a2b21a087354d8c9fc9dfe2d869f8761fe2714e2806d8f0a597fbe929cd999
Opcode Fuzzy Hash: 0e29ab10ff8567d919b78903a6a782e911053938b663a8a038d2bb152009cb07
Instruction Fuzzy Hash: 86118E71E01228BFDB108F95EC45FAFBBBCEB45B60F108111F914E7290C2B04A059BE1

Function 00F31663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F3168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F316A1
FreeSid.ADVAPI32(?), ref: 00F316B1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 867e6334e15a9a17d39ec3dcee7d02e664083b59ace483b4ac305294c056204d
Instruction ID: dc89ae1cb823f35379f810e18a519fd43ff80b0d6ce2f906dbd6a7952f31a5ac
Opcode Fuzzy Hash: 867e6334e15a9a17d39ec3dcee7d02e664083b59ace483b4ac305294c056204d
Instruction Fuzzy Hash: 5FF0447195030CFBDB00DFE08D89AAEBBBCFB08200F404461E940E2180E370AA04AA90

Function 00F2D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00F2D28C

Strings

X64, xrefs: 00F2D2A8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 0fc0eeeef4d18178d175a99f11f50f32053e2a5034e27a4a75f35794399c124f
Instruction ID: 3edea6fba5155dc6f9aac4193e4cfd5a7d58b8e14ec8ba3d00f04c2e535a6e11
Opcode Fuzzy Hash: 0fc0eeeef4d18178d175a99f11f50f32053e2a5034e27a4a75f35794399c124f
Instruction Fuzzy Hash: B8D0CAB580512DFACB94CBA0EC88EEAB3BCBB04305F100292F146E2040DB709648AF60

Function 00EFCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: bff5b43e16a6fcda3398f4ecf8cb61d1c899a3b007756304f141524d65a5e351
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 1E02F872E0021D9BDF14CFA9C9806ADFBF1EF88314F35916AD919B7284D731AA41CB94

Function 00F468EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F46918
FindClose.KERNEL32(00000000), ref: 00F46961

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6ab3aedd0f396336942ce161a944768cdca7c8cea2432e6a7e0078848f92c4c7
Instruction ID: 97c88a1551a22ab6445c03517d4c9bcde31788e5792959ca6b80cc7618cd5939
Opcode Fuzzy Hash: 6ab3aedd0f396336942ce161a944768cdca7c8cea2432e6a7e0078848f92c4c7
Instruction Fuzzy Hash: 611190316042019FD710DF29D484A26BBE5FF85328F15C69AE8A99F3A2C770EC45CB91

Function 00F437B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00F54891,?,?,00000035,?), ref: 00F437E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00F54891,?,?,00000035,?), ref: 00F437F4

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 85961e7f1e1fcda8cfb1f87a60786eb211e6651b2bd3d76c2d63dcc0987a50a6
Instruction ID: a6d0c08c9906e53dba7da1c46bffa40dbeac5530afeff71e725c18e8bae35718
Opcode Fuzzy Hash: 85961e7f1e1fcda8cfb1f87a60786eb211e6651b2bd3d76c2d63dcc0987a50a6
Instruction Fuzzy Hash: 00F0E5B16052282AE72017668C4EFEB7AAEEFC4761F000165F949E2281D9A09944D6F0

Function 00F3B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00F3B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00F3B270

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 55b4d9a85e04e168b5b4060a8a727da619c1e8e7f7e96e583f47cfbde1103703
Instruction ID: 952e72079c3644e177760e53c95fce53e74d652183a93c28e2bbc6a3a1f8b65f
Opcode Fuzzy Hash: 55b4d9a85e04e168b5b4060a8a727da619c1e8e7f7e96e583f47cfbde1103703
Instruction Fuzzy Hash: 27F01D7180428DABDB059FA1C806BBE7BB4FF04319F04800AF9A5A6192C7B9C611AF94

Function 00F310BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F311FC), ref: 00F310D4
CloseHandle.KERNEL32(?,?,00F311FC), ref: 00F310E9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: c5d8e4eefda6589e96fa28dd0c42e8de7c458dda7a915727a8bd005c7cdf3378
Instruction ID: 0102c58e26963407f72f2cc76c1b2eef562b314fdc49239c7d7d0ac12c392cf4
Opcode Fuzzy Hash: c5d8e4eefda6589e96fa28dd0c42e8de7c458dda7a915727a8bd005c7cdf3378
Instruction Fuzzy Hash: 49E0BF72018655AEF7252B52FC05F777BE9EB04320F14882DF5E5905B1DBA26C90EB50

Function 00EDCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00F20C40

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 2e47a6b7b11a6075075b250757c094ca6cb69b6426cb2f7b35a554df05a0c265
Instruction ID: 6356978c7840109be0f4e6c7e91395cbcd7ae3a2c1624ba1272ca80d65769b46
Opcode Fuzzy Hash: 2e47a6b7b11a6075075b250757c094ca6cb69b6426cb2f7b35a554df05a0c265
Instruction Fuzzy Hash: 2432AB71A00219DBCF14DF90D880AEDB7B5FF04358F24506AE806BB392DB75AE46DB60

Function 00F0676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F06766,?,?,00000008,?,?,00F0FEFE,00000000), ref: 00F06998

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 208570cf1bce4b46bd7d7eb919aa794d48d6a1c54225a6c1bb99091981c8146a
Instruction ID: 09868b170a919d9a39bff20d225915c3aa76d70dea8b8a0dd20e54f88c1f3d17
Opcode Fuzzy Hash: 208570cf1bce4b46bd7d7eb919aa794d48d6a1c54225a6c1bb99091981c8146a
Instruction Fuzzy Hash: 44B11A32A106099FDB15CF28C486B657BE0FF45364F25C658E899CF2E2C735E9A1EB40

Function 00EEB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00F2851F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: fd9ce78d3e7e4218576be40bfcb13bf718711269a1f59463d1dc779781af1d59
Instruction ID: bb6622126a5f623fa322de1fc57f41f1788b2417ebe3c76e55a77172cd065c6c
Opcode Fuzzy Hash: fd9ce78d3e7e4218576be40bfcb13bf718711269a1f59463d1dc779781af1d59
Instruction Fuzzy Hash: 12126D71D002299BCB24CF59D8816EEB7F5FF48710F1481AAE849EB255EB349E81DF90

Function 00F4EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00F4EABD

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d97f3fa3a15e270877c4908560d9a3404eb899b4684e67f56e9fd6cac4767d0e
Instruction ID: 93d6a1cccc02ecb14c94016dd8e2192c68711ba3865e711b15aca7900ffca234
Opcode Fuzzy Hash: d97f3fa3a15e270877c4908560d9a3404eb899b4684e67f56e9fd6cac4767d0e
Instruction Fuzzy Hash: 15E01A322002059FC710EF59D804E9ABBE9FF98760F008416FD49D7361DAB4A8419B90

Function 00EF09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00EF03EE), ref: 00EF09DA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 45f41cb9d30a011fcbb4f066444503ea975914218e8277e0bae532daa80a60de
Instruction ID: 181d665e8ec61d74d85bdf618e852c60f624492ff28b67659bac1842816d46ec
Opcode Fuzzy Hash: 45f41cb9d30a011fcbb4f066444503ea975914218e8277e0bae532daa80a60de
Instruction Fuzzy Hash:

Function 00EF781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00EF798B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: a92c9981514009ed00ebb1a0256099c12046bab7b1ce0c09543b894a5449470e
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 0E51972160CB9D5BDB3C8968895A7FF63D59B82388F583509DBC2F7282C671DE42C352

Function 00F06DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb65ad41b5de47e9b31795b5b0363023d55b7f1a7ade5d6cfe2e3a5067a985e5
Instruction ID: 56515138ecb8dab8ed2570f08ac05815044e261c72a01b7a6bbcdcf20fa24b25
Opcode Fuzzy Hash: bb65ad41b5de47e9b31795b5b0363023d55b7f1a7ade5d6cfe2e3a5067a985e5
Instruction Fuzzy Hash: 11325622D29F014DD763A634CC22335A289AFB73D5F24C737F81AB59A6EB29D4C36101

Function 00EECC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d9813d1a3297711a5693dfb1062004a6f7d5cc841da4cea3a97c90a8ca23b9
Instruction ID: ae184251ea413e7a495cf2e64f13d0e3ef00b07d3bbdd3d5dd44d6900d6dfad3
Opcode Fuzzy Hash: 74d9813d1a3297711a5693dfb1062004a6f7d5cc841da4cea3a97c90a8ca23b9
Instruction Fuzzy Hash: DB321B32E001A98BCF24CF29D494A7DBBA1EF45314F398566E4599B291D234DD82FB81

Function 00ED7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89f46dd92c612aafad2de29c798773fd2583234eb8c09c262e23cb3ccb98db1
Instruction ID: 9c518917aff2328750d28a62f7badeb6b0b8a6ae7681c69a012e4e329f845b16
Opcode Fuzzy Hash: c89f46dd92c612aafad2de29c798773fd2583234eb8c09c262e23cb3ccb98db1
Instruction Fuzzy Hash: F322AD70A00609DFDF14CF65C881AEEB3F2FF84714F14562AE852AB391EB36A951DB50

Function 00ED91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9b0c91cdd440c7e25527df1ff05a6042e27814d4436ff7f69a77c87f75a2cc
Instruction ID: eec44ad9ef0dc50b52eab0484b8b7626b7aeee1232dbe2c948d1d2b4e2e778eb
Opcode Fuzzy Hash: ef9b0c91cdd440c7e25527df1ff05a6042e27814d4436ff7f69a77c87f75a2cc
Instruction Fuzzy Hash: 450294B1E00209EBDB04DF65D881AEDB7F5FF44310F108169E816AB391EB35AE51DB91

Function 00F09EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c41a11f63c016edc9b95aa318eb5e7a6aa0e5c5d57535a829d94830a789736
Instruction ID: d68e92638beea8109fc282dd3242a897d545aba697145df6b585ca7c7f9396ca
Opcode Fuzzy Hash: e0c41a11f63c016edc9b95aa318eb5e7a6aa0e5c5d57535a829d94830a789736
Instruction Fuzzy Hash: 38B12420D2AF455DD36396398831336B64CAFBB2D5F91D31BFC1A74D62EB2285C36142

Function 00EF1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: b1f0e59305417244fac54e61223901341bccdf330597436db8af177781387140
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 9F9187322080EF8ADB2D463A857407DFFF15A923A631A17DED5F2EA1C5FE20C954D620

Function 00EF1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 1e554a8d24fc0899581bc2f37216fc7d6da3e645634ca758d67d7e0418afc29e
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 369197732090AB4ADB2D423A843407EFFE15A923A531A17DDD7F2EB1C5EF24C954E620

Function 00EF19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: c8ee3052a579368caa79b7682c51fe67d8ed0c406831348d572c51526a8bc2e1
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: CD91B5322090EFCADB2D427A847407DFFE15A923A631A27DED5F2EA1C1FE14C554D620

Function 00EF7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8403f338f52c25627e982770ab8ccabe4957e9107acee97cf14fd0dc5e862d24
Instruction ID: 34f76bc9a9ec9898172af6e81ef0f97eeb7ef35f68e169e3279a6c2fe9475481
Opcode Fuzzy Hash: 8403f338f52c25627e982770ab8ccabe4957e9107acee97cf14fd0dc5e862d24
Instruction Fuzzy Hash: 7961693120CB0D96EA349A2C8D95BFE63D6DF46748F10391AEBC2FB281D6719E42C355

Function 00EF7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbc34f3154470def41ff1d5e99be9abf3fe889dc498ae2000d3fe5789c48d16
Instruction ID: f1aa3a60e105e459b74c25200d02a39518aae88d294e18ebb1dac66cb723b41d
Opcode Fuzzy Hash: 2dbc34f3154470def41ff1d5e99be9abf3fe889dc498ae2000d3fe5789c48d16
Instruction Fuzzy Hash: B161453160860D56DE384A285955BFE2389AF8370CF90795EEBC2FB281DA73AD42C255

Function 00EF1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: f32be379848177f04914006fa322859e0ad3ae6796c7c28f3934791fc7adb1ac
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 9681A7336080EF89DB2D423A853407EFFE15A923A531A17DED5F6EB1C1EE24C654E660

Function 00F42046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b818d0d3409f243890469083013c55be23edd88466f56792d28f496bde12825
Instruction ID: 3b4bf5b91dbad763819038f7dc6582a3e51aef366ff12b32c070c5d343f3e23f
Opcode Fuzzy Hash: 1b818d0d3409f243890469083013c55be23edd88466f56792d28f496bde12825
Instruction Fuzzy Hash: 6921D2727216158BDB28CF7DC82267E77E5A754320F148A2EE4A7C37D0DE39A904DB90

Function 00F52ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F52B30
DeleteObject.GDI32(00000000), ref: 00F52B43
DestroyWindow.USER32 ref: 00F52B52
GetDesktopWindow.USER32 ref: 00F52B6D
GetWindowRect.USER32(00000000), ref: 00F52B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00F52CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00F52CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52CF8
GetClientRect.USER32(00000000,?), ref: 00F52D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00F52D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52D80
GlobalLock.KERNEL32(00000000), ref: 00F52D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52D98
GlobalUnlock.KERNEL32(00000000), ref: 00F52DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52DA8
GlobalFree.KERNEL32(00000000), ref: 00F52DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00F6FC38,00000000), ref: 00F52DDB
GlobalFree.KERNEL32(00000000), ref: 00F52DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00F52E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00F52E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F52E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F5303F

Strings

static, xrefs: 00F52D3A, 00F52E91
, xrefs: 00F52FC5
AutoIt v3, xrefs: 00F52CF2
DISPLAY, xrefs: 00F52EA2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: b0261d76fb52950f40ddff1be7e2b79bf3df8ea48454e244aba947706ed2e706
Instruction ID: 0c86732f16a87d576cc7ffb8159e6fec78986250b110cc5139c06e68623ffcc0
Opcode Fuzzy Hash: b0261d76fb52950f40ddff1be7e2b79bf3df8ea48454e244aba947706ed2e706
Instruction Fuzzy Hash: BD028D71A00209EFDB14DF64DC89EAE7BB9FB49311F008219F955AB2A1D770ED05DBA0

Function 00F670D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00F6712F
GetSysColorBrush.USER32(0000000F), ref: 00F67160
GetSysColor.USER32(0000000F), ref: 00F6716C
SetBkColor.GDI32(?,000000FF), ref: 00F67186
SelectObject.GDI32(?,?), ref: 00F67195
InflateRect.USER32(?,000000FF,000000FF), ref: 00F671C0
GetSysColor.USER32(00000010), ref: 00F671C8
CreateSolidBrush.GDI32(00000000), ref: 00F671CF
FrameRect.USER32(?,?,00000000), ref: 00F671DE
DeleteObject.GDI32(00000000), ref: 00F671E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00F67230
FillRect.USER32(?,?,?), ref: 00F67262
GetWindowLongW.USER32(?,000000F0), ref: 00F67284

Part of subcall function 00F673E8: GetSysColor.USER32(00000012), ref: 00F67421
Part of subcall function 00F673E8: SetTextColor.GDI32(?,?), ref: 00F67425
Part of subcall function 00F673E8: GetSysColorBrush.USER32(0000000F), ref: 00F6743B
Part of subcall function 00F673E8: GetSysColor.USER32(0000000F), ref: 00F67446
Part of subcall function 00F673E8: GetSysColor.USER32(00000011), ref: 00F67463
Part of subcall function 00F673E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F67471
Part of subcall function 00F673E8: SelectObject.GDI32(?,00000000), ref: 00F67482
Part of subcall function 00F673E8: SetBkColor.GDI32(?,00000000), ref: 00F6748B
Part of subcall function 00F673E8: SelectObject.GDI32(?,?), ref: 00F67498
Part of subcall function 00F673E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00F674B7
Part of subcall function 00F673E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F674CE
Part of subcall function 00F673E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00F674DB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 69f28e31cfb12b74697742d2e860b6a82b728e22fc7df4bae31473a557c3f640
Instruction ID: e59a5af441bd96e5f136d294fa102da0f399903eb12b5e036ae905143d10ae29
Opcode Fuzzy Hash: 69f28e31cfb12b74697742d2e860b6a82b728e22fc7df4bae31473a557c3f640
Instruction Fuzzy Hash: D2A18072408305AFDB00AF60DC48A6B7BA9FF49324F140A19F9E2961E1D7B5E944EF91

Function 00EE8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00EE8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00F26AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F26AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F26F43

Part of subcall function 00EE8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EE8BE8,?,00000000,?,?,?,?,00EE8BBA,00000000,?), ref: 00EE8FC5

SendMessageW.USER32(?,00001053), ref: 00F26F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F26F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00F26FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00F26FB7

Strings

0, xrefs: 00F26DCF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: ef96aeb03ddee60bfe66ad875424115251f06b688c09932458f4bdfa77b3c27e
Instruction ID: 8b9b506cf418d0cf326ff56afcd3a57384ee107ec0d1ca245aae96a768cbf887
Opcode Fuzzy Hash: ef96aeb03ddee60bfe66ad875424115251f06b688c09932458f4bdfa77b3c27e
Instruction Fuzzy Hash: 9B12DD30A00269EFDB25DF24ED44BAAB7E1FB49320F144069F499DB261CB31EC51EB91

Function 00F52711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00F5273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F5286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00F528A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00F528B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00F52900
GetClientRect.USER32(00000000,?), ref: 00F5290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00F52955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F52964
GetStockObject.GDI32(00000011), ref: 00F52974
SelectObject.GDI32(00000000,00000000), ref: 00F52978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00F52988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F52991
DeleteDC.GDI32(00000000), ref: 00F5299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F529C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00F529DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00F52A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F52A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00F52A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00F52A77
GetStockObject.GDI32(00000011), ref: 00F52A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F52A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00F52A97

Strings

static, xrefs: 00F5294F, 00F52A71
AutoIt v3, xrefs: 00F528F8
DISPLAY, xrefs: 00F5295A
msctls_progress32, xrefs: 00F52A13

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4c3528fb6d0b53670b13550925a2cc1604780e762f33ab7f36ffd712371c9274
Instruction ID: 086d8a2396bc51a819d1b1bdc61b2a0f94656c8f69df283eefb74347129f380e
Opcode Fuzzy Hash: 4c3528fb6d0b53670b13550925a2cc1604780e762f33ab7f36ffd712371c9274
Instruction Fuzzy Hash: 9AB15CB1A00219AFEB14DFA8DC45EAA7BB9FB09711F004215FA54E7290D7B4ED40DB94

Function 00F44ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F44AED
GetDriveTypeW.KERNEL32(?,00F6CB68,?,\\.\,00F6CC08), ref: 00F44BCA
SetErrorMode.KERNEL32(00000000,00F6CB68,?,\\.\,00F6CC08), ref: 00F44D36

Strings

\\.\, xrefs: 00F44B3F
SSD, xrefs: 00F44C4A
Virtual, xrefs: 00F44CE5
SATA, xrefs: 00F44CD0
SCSI, xrefs: 00F44C8A
ATAPI, xrefs: 00F44C91
RAID, xrefs: 00F44CBB
USB, xrefs: 00F44CB4
FileBackedVirtual, xrefs: 00F44CEC
MMC, xrefs: 00F44CDE
iSCSI, xrefs: 00F44CC2
Network, xrefs: 00F44C02
CDROM, xrefs: 00F44BFB
ATA, xrefs: 00F44C98
Fixed, xrefs: 00F44C09
1394, xrefs: 00F44C9F
Unknown, xrefs: 00F44BED, 00F44C83
RAMDisk, xrefs: 00F44BF4
PhysicalDrive, xrefs: 00F44B76
SSA, xrefs: 00F44CA6
SAS, xrefs: 00F44CC9
Removable, xrefs: 00F44C10, 00F44C15
Fibre, xrefs: 00F44CAD

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: dc8e0fb7d702bdd9562d2dad8107851c9d0edc11af742a181118503b577cc6f7
Instruction ID: c28cc5122e4b9ab6f19196f912a5e163628c20aa384997e298705a2221f3ec86
Opcode Fuzzy Hash: dc8e0fb7d702bdd9562d2dad8107851c9d0edc11af742a181118503b577cc6f7
Instruction Fuzzy Hash: BD619E31A051069BDF04DB24CAC2B69BBA0EB44355B284016FD16FB6D2EB35FD41BB82

Function 00F673E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00F67421
SetTextColor.GDI32(?,?), ref: 00F67425
GetSysColorBrush.USER32(0000000F), ref: 00F6743B
GetSysColor.USER32(0000000F), ref: 00F67446
CreateSolidBrush.GDI32(?), ref: 00F6744B
GetSysColor.USER32(00000011), ref: 00F67463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F67471
SelectObject.GDI32(?,00000000), ref: 00F67482
SetBkColor.GDI32(?,00000000), ref: 00F6748B
SelectObject.GDI32(?,?), ref: 00F67498
InflateRect.USER32(?,000000FF,000000FF), ref: 00F674B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F674CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00F674DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F6752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F67554
InflateRect.USER32(?,000000FD,000000FD), ref: 00F67572
DrawFocusRect.USER32(?,?), ref: 00F6757D
GetSysColor.USER32(00000011), ref: 00F6758E
SetTextColor.GDI32(?,00000000), ref: 00F67596
DrawTextW.USER32(?,00F670F5,000000FF,?,00000000), ref: 00F675A8
SelectObject.GDI32(?,?), ref: 00F675BF
DeleteObject.GDI32(?), ref: 00F675CA
SelectObject.GDI32(?,?), ref: 00F675D0
DeleteObject.GDI32(?), ref: 00F675D5
SetTextColor.GDI32(?,?), ref: 00F675DB
SetBkColor.GDI32(?,?), ref: 00F675E5

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b51f390d20fba4fdf8a6595131573d15236be4b0f88bfcd23ff4ab8fec970729
Instruction ID: 95cdae00cf1839c9bba15b8cb1a25b3db2878e2d2f7183473854ca7730b501ef
Opcode Fuzzy Hash: b51f390d20fba4fdf8a6595131573d15236be4b0f88bfcd23ff4ab8fec970729
Instruction Fuzzy Hash: B2616E72D00218AFDF01AFA4DC49AAE7FB9EF09320F144115F965AB2A1D7B59D40EF90

Function 00F60FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F61128
GetDesktopWindow.USER32 ref: 00F6113D
GetWindowRect.USER32(00000000), ref: 00F61144
GetWindowLongW.USER32(?,000000F0), ref: 00F61199
DestroyWindow.USER32(?), ref: 00F611B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F611ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F6120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F6121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00F61232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00F61245
IsWindowVisible.USER32(00000000), ref: 00F612A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00F612BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00F612D0
GetWindowRect.USER32(00000000,?), ref: 00F612E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00F6130E
GetMonitorInfoW.USER32(00000000,?), ref: 00F61328
CopyRect.USER32(?,?), ref: 00F6133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00F613AA

Strings

tooltips_class32, xrefs: 00F611E6
(, xrefs: 00F6131B
0, xrefs: 00F610D3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 9c04c7663fbbb88e0b2d01831cd60afca18184d327ae90cd14431435d9eec403
Instruction ID: 10616a9f9a3630fd2ced416fc8d683cc2caaf8523b966a9ba805e5d9dbcf92a7
Opcode Fuzzy Hash: 9c04c7663fbbb88e0b2d01831cd60afca18184d327ae90cd14431435d9eec403
Instruction Fuzzy Hash: F5B1BD71604341AFDB00DF64C885B6ABBE4FF88310F04891DF99AAB2A1D771EC45DB96

Function 00EE8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EE8968
GetSystemMetrics.USER32(00000007), ref: 00EE8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EE899B
GetSystemMetrics.USER32(00000008), ref: 00EE89A3
GetSystemMetrics.USER32(00000004), ref: 00EE89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00EE89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00EE89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00EE8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00EE8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00EE8A5A
GetStockObject.GDI32(00000011), ref: 00EE8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00EE8A81

Part of subcall function 00EE912D: GetCursorPos.USER32(?), ref: 00EE9141
Part of subcall function 00EE912D: ScreenToClient.USER32(00000000,?), ref: 00EE915E
Part of subcall function 00EE912D: GetAsyncKeyState.USER32(00000001), ref: 00EE9183
Part of subcall function 00EE912D: GetAsyncKeyState.USER32(00000002), ref: 00EE919D

SetTimer.USER32(00000000,00000000,00000028,00EE90FC), ref: 00EE8AA8

Strings

AutoIt v3 GUI, xrefs: 00EE8A20

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5c42a35854cf699ddd9f87f55dffe343147775daa1f2cb2d6588c6d8e34bb507
Instruction ID: ef9c49e6b8bb97d0177b7488b9c381b82cae464bbc08453372fd8d384bec3377
Opcode Fuzzy Hash: 5c42a35854cf699ddd9f87f55dffe343147775daa1f2cb2d6588c6d8e34bb507
Instruction Fuzzy Hash: 6FB19B75A0024D9FDB14DFA8DD45BAE3BB4FB48314F114229FA59E7290DB74E840DB90

Function 00F30D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F31114
Part of subcall function 00F310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F31120
Part of subcall function 00F310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F3112F
Part of subcall function 00F310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F31136
Part of subcall function 00F310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F3114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F30DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F30E29
GetLengthSid.ADVAPI32(?), ref: 00F30E40
GetAce.ADVAPI32(?,00000000,?), ref: 00F30E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F30E96
GetLengthSid.ADVAPI32(?), ref: 00F30EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F30EB5
HeapAlloc.KERNEL32(00000000), ref: 00F30EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F30EDD
CopySid.ADVAPI32(00000000), ref: 00F30EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F30F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F30F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F30F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F30F6E
HeapFree.KERNEL32(00000000), ref: 00F30F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F30F7E
HeapFree.KERNEL32(00000000), ref: 00F30F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F30F8E
HeapFree.KERNEL32(00000000), ref: 00F30F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00F30FA1
HeapFree.KERNEL32(00000000), ref: 00F30FA8

Part of subcall function 00F31193: GetProcessHeap.KERNEL32(00000008,00F30BB1,?,00000000,?,00F30BB1,?), ref: 00F311A1
Part of subcall function 00F31193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F30BB1,?), ref: 00F311A8
Part of subcall function 00F31193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F30BB1,?), ref: 00F311B7

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 51f9aeb74439b869961610d3ae93862826ad9b4ff286b8ab5bd129d8f9fa0002
Instruction ID: c2b581b5f79184e366df98509d8c16335647d2c528b1c76ecfc62cb8569e429a
Opcode Fuzzy Hash: 51f9aeb74439b869961610d3ae93862826ad9b4ff286b8ab5bd129d8f9fa0002
Instruction Fuzzy Hash: D0715E7290020AEBDF209FA5DC44FEEBBB8FF05720F144116F9A9E6191DB719905DBA0

Function 00F5C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F5C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00F6CC08,00000000,?,00000000,?,?), ref: 00F5C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00F5C5A4
_wcslen.LIBCMT ref: 00F5C5F4
_wcslen.LIBCMT ref: 00F5C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00F5C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00F5C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00F5C84D
RegCloseKey.ADVAPI32(?), ref: 00F5C881
RegCloseKey.ADVAPI32(00000000), ref: 00F5C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00F5C960

Strings

REG_MULTI_SZ, xrefs: 00F5C6F5
REG_SZ, xrefs: 00F5C644
REG_DWORD, xrefs: 00F5C804
REG_EXPAND_SZ, xrefs: 00F5C5CD
REG_BINARY, xrefs: 00F5C913
REG_QWORD, xrefs: 00F5C8C3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 177569c2647da7f90c260f401cad2508254fc8010772eb9a9b9d948f20a67e91
Instruction ID: 7c90732ae286da755caa495000f02ab75b192bb3adec16786958c813f63cd6f9
Opcode Fuzzy Hash: 177569c2647da7f90c260f401cad2508254fc8010772eb9a9b9d948f20a67e91
Instruction Fuzzy Hash: 01127C356043019FD714DF14C881A2AB7E5FF88725F14885DF98AAB3A2DB31ED46DB81

Function 00F6091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F609C6
_wcslen.LIBCMT ref: 00F60A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F60A54
_wcslen.LIBCMT ref: 00F60A8A
_wcslen.LIBCMT ref: 00F60B06
_wcslen.LIBCMT ref: 00F60B81

Part of subcall function 00EEF9F2: _wcslen.LIBCMT ref: 00EEF9FD

Part of subcall function 00F32BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F32BFA

Strings

GETTEXT, xrefs: 00F60C97
EXISTS, xrefs: 00F60B7C, 00F60B97
SELECT, xrefs: 00F60D11
GETITEMCOUNT, xrefs: 00F60C1E
COLLAPSE, xrefs: 00F60B01, 00F60B1C
GETTOTALCOUNT, xrefs: 00F609F2, 00F60A17
CHECK, xrefs: 00F60A85, 00F60AA0
UNCHECK, xrefs: 00F60D3E
GETSELECTED, xrefs: 00F60C4E
EXPAND, xrefs: 00F60BF8
ISCHECKED, xrefs: 00F60CE1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: cf57a407cddc535183720c080aea4067b6c870e3042e436d34afd0e129dfd5a5
Instruction ID: b5f11303fd24351ea34e4c5c3d82153bb35fb86780fbd90d2fe0fe032efef29b
Opcode Fuzzy Hash: cf57a407cddc535183720c080aea4067b6c870e3042e436d34afd0e129dfd5a5
Instruction Fuzzy Hash: A2E17D326083019FCB14DF64C45092BB7E2FF94364B24895DF896AB3A2DB31ED45EB81

Function 00F5C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F5B6AE,?,?), ref: 00F5C9B5
_wcslen.LIBCMT ref: 00F5C9F1
_wcslen.LIBCMT ref: 00F5CA68
_wcslen.LIBCMT ref: 00F5CA9E
_wcslen.LIBCMT ref: 00F5CAF9
_wcslen.LIBCMT ref: 00F5CB2F
_wcslen.LIBCMT ref: 00F5CB7F

Strings

HKU, xrefs: 00F5CBF0
HKCU, xrefs: 00F5CBCE
HKEY_CURRENT_CONFIG, xrefs: 00F5CB79, 00F5CB7E
HKEY_LOCAL_MACHINE, xrefs: 00F5CA62, 00F5CA67
HKEY_USERS, xrefs: 00F5CBDF
HKEY_CURRENT_USER, xrefs: 00F5CBBD
HKCC, xrefs: 00F5CBAC
HKEY_CLASSES_ROOT, xrefs: 00F5CAF3, 00F5CAF8
HKLM, xrefs: 00F5CA98, 00F5CA9D
HKCR, xrefs: 00F5CB29, 00F5CB2E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 3eb1e758bed6daea063360a0209dcabb30f6399a109765ec42724434616d05de
Instruction ID: 15a42c97b7e485e5712538318ef69d809dfcc08236e97f0242d6e2d64ba73dfa
Opcode Fuzzy Hash: 3eb1e758bed6daea063360a0209dcabb30f6399a109765ec42724434616d05de
Instruction Fuzzy Hash: 3E711633A0036A8FCF20DE78CD515BB3791ABA1765B150128FE57A7285E635CD49E3D0

Function 00F6833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F6835A
_wcslen.LIBCMT ref: 00F6836E
_wcslen.LIBCMT ref: 00F68391
_wcslen.LIBCMT ref: 00F683B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00F683F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00F6361A,?), ref: 00F6844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F68487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00F684CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F68501
FreeLibrary.KERNEL32(?), ref: 00F6850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F6851D
DestroyIcon.USER32(?), ref: 00F6852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00F68549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00F68555

Strings

.exe, xrefs: 00F68388
.icl, xrefs: 00F68368
.dll, xrefs: 00F683AB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: c25f831aea5cb8ebf27635703ebad5902a6127db4a743e3d675778b38b776dc0
Instruction ID: 74678b385eccf1d989c9b986ef05d0f7f4ba2298995b650c6bed0c35f2fbc719
Opcode Fuzzy Hash: c25f831aea5cb8ebf27635703ebad5902a6127db4a743e3d675778b38b776dc0
Instruction Fuzzy Hash: 1961DF71900209BAEB14DF64CC41BBE77A8FB04760F10460AF956E61D1EFB4AE81E7A0

Function 00ED7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#comments-end, xrefs: 00ED78D9
#cs, xrefs: 00ED7873, 00ED78C5
#requireadmin, xrefs: 00ED77FF
", xrefs: 00F15153
#comments-start, xrefs: 00ED785F, 00ED78B1
#pragma compile, xrefs: 00ED77D3
Cannot parse #include, xrefs: 00F15279
#notrayicon, xrefs: 00ED77E7
Unterminated group of comments, xrefs: 00F1528C
', xrefs: 00F15169
#ce, xrefs: 00ED78ED
Bad directive syntax error, xrefs: 00F1519A
#include, xrefs: 00ED7847
#OnAutoItStartRegister, xrefs: 00ED7817
#include-once, xrefs: 00ED782F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 0e9cecef36e196843a65f8bd655d12e62dd5a26ca432daf7932dab42878d0a88
Instruction ID: 1167e74aad5e89a17e9bac8e8706659affb9e4d20f341153a49ced8dcc0ad10a
Opcode Fuzzy Hash: 0e9cecef36e196843a65f8bd655d12e62dd5a26ca432daf7932dab42878d0a88
Instruction Fuzzy Hash: FD810771A04205BBDB21AF60DD42FFE37A4EF95700F045426F945BA292FB70D942E7A1

Function 00F43E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00F43EF8
_wcslen.LIBCMT ref: 00F43F03
_wcslen.LIBCMT ref: 00F43F5A
_wcslen.LIBCMT ref: 00F43F98
GetDriveTypeW.KERNEL32(?), ref: 00F43FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F4401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F44059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F44087

Strings

open , xrefs: 00F43FE5
close cd wait, xrefs: 00F44072
type cdaudio alias cd wait, xrefs: 00F44001
wait, xrefs: 00F44044
set cd door , xrefs: 00F44028
open, xrefs: 00F43F54, 00F43F59
closed, xrefs: 00F43F08, 00F43F2D, 00F43F46, 00F43F7E, 00F43F97
close, xrefs: 00F43EFE, 00F43F18

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: e956e4fb90161f0ebe8ddbf0fcda1b7421e8ca1d2efbde74cbbe2bbbe42bd49a
Instruction ID: 035388609549f6e695b949d5db4a9f4303f283cd047d24ffd1b08ce6c8bf6940
Opcode Fuzzy Hash: e956e4fb90161f0ebe8ddbf0fcda1b7421e8ca1d2efbde74cbbe2bbbe42bd49a
Instruction Fuzzy Hash: 3271E472A042029FC714DF24C88196ABBF4EF94768F10492DF895E7251E731ED4ADB91

Function 00F35A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00F35A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F35A40
SetWindowTextW.USER32(?,?), ref: 00F35A57
GetDlgItem.USER32(?,000003EA), ref: 00F35A6C
SetWindowTextW.USER32(00000000,?), ref: 00F35A72
GetDlgItem.USER32(?,000003E9), ref: 00F35A82
SetWindowTextW.USER32(00000000,?), ref: 00F35A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00F35AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00F35AC3
GetWindowRect.USER32(?,?), ref: 00F35ACC
_wcslen.LIBCMT ref: 00F35B33
SetWindowTextW.USER32(?,?), ref: 00F35B6F
GetDesktopWindow.USER32 ref: 00F35B75
GetWindowRect.USER32(00000000), ref: 00F35B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00F35BD3
GetClientRect.USER32(?,?), ref: 00F35BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00F35C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00F35C2F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: db0ceaacb9cd0b4a5a799ff8e31125e308fb178dedc7674d64c273cd6da20487
Instruction ID: 0285b1c2747aafd5e672e7cba7d0837ef1a4e37c0c3330c321161a5ed7fb37d4
Opcode Fuzzy Hash: db0ceaacb9cd0b4a5a799ff8e31125e308fb178dedc7674d64c273cd6da20487
Instruction Fuzzy Hash: 0D719031900B09AFDB20DFA8CE45B6EBBF5FF88B24F104518E596A35A0D775E940EB50

Function 00F4FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00F4FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00F4FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00F4FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00F4FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00F4FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00F4FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00F4FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00F4FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00F4FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00F4FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00F4FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00F4FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00F4FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00F4FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00F4FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00F4FECC
GetCursorInfo.USER32(?), ref: 00F4FEDC
GetLastError.KERNEL32 ref: 00F4FF1E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: da09a1f25e2396522d7880fc563608efe255d0d1e92906e1eaad401cfade7749
Instruction ID: d6bbde4db04f3e7de044d3b32931d378e9806d88f490ffcfb7a12a77b2f8e3e1
Opcode Fuzzy Hash: da09a1f25e2396522d7880fc563608efe255d0d1e92906e1eaad401cfade7749
Instruction Fuzzy Hash: FF4154B0D043196BDB109FBA8C8585EBFE8FF04364B54452AE51DEB281DB789905CE91

Function 00EF00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00EF00C6

Part of subcall function 00EF00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00FA070C,00000FA0,F6C20459,?,?,?,?,00F123B3,000000FF), ref: 00EF011C
Part of subcall function 00EF00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00F123B3,000000FF), ref: 00EF0127
Part of subcall function 00EF00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00F123B3,000000FF), ref: 00EF0138
Part of subcall function 00EF00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00EF014E
Part of subcall function 00EF00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00EF015C
Part of subcall function 00EF00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00EF016A
Part of subcall function 00EF00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00EF0195
Part of subcall function 00EF00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00EF01A0

___scrt_fastfail.LIBCMT ref: 00EF00E7

Part of subcall function 00EF00A3: __onexit.LIBCMT ref: 00EF00A9

Strings

kernel32.dll, xrefs: 00EF0133
WakeAllConditionVariable, xrefs: 00EF0162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00EF0122
SleepConditionVariableCS, xrefs: 00EF0154
InitializeConditionVariable, xrefs: 00EF0148

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: a4e536a06c97184892f9ce4734c9174c7ec46bfaaee265ccb0671f5cb1a42a8f
Instruction ID: 57502f9efe00425b4c2493b83a013a4acbb9f1474c9a0bbf7e50f0610bd9ccc9
Opcode Fuzzy Hash: a4e536a06c97184892f9ce4734c9174c7ec46bfaaee265ccb0671f5cb1a42a8f
Instruction Fuzzy Hash: F2210B7264575D6BD7106BA4BC05B7A33D4DB06B65F001536F991F3292DFB0EC00AAD1

Function 00F330F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F3318D
_wcslen.LIBCMT ref: 00F331F8

Strings

INSTANCE, xrefs: 00F33453
NAME, xrefs: 00F33335, 00F33346
CLASS, xrefs: 00F33188, 00F331A5
REGEXPCLASS, xrefs: 00F33255, 00F33266
CLASSNN, xrefs: 00F331F3, 00F33204
TEXT, xrefs: 00F3347C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 2bd4f7d2126f074d3d960c1104af83735b18b00245ad418acedeca14f9f830b7
Instruction ID: b9cb3b72a801a791c5153dafa50f390a56b8b2fa2a296080d1fda5e4bf19d178
Opcode Fuzzy Hash: 2bd4f7d2126f074d3d960c1104af83735b18b00245ad418acedeca14f9f830b7
Instruction Fuzzy Hash: 48E1B232E00516ABDB19DFB8C8517FEBBB0BF54730F54812AE456B7241DB30AE85A790

Function 00F444C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00F6CC08), ref: 00F44527
_wcslen.LIBCMT ref: 00F4453B
_wcslen.LIBCMT ref: 00F44599
_wcslen.LIBCMT ref: 00F445F4
_wcslen.LIBCMT ref: 00F4463F
_wcslen.LIBCMT ref: 00F446A7

Part of subcall function 00EEF9F2: _wcslen.LIBCMT ref: 00EEF9FD

GetDriveTypeW.KERNEL32(?,00F96BF0,00000061), ref: 00F44743

Strings

fixed, xrefs: 00F44635, 00F4463A
all, xrefs: 00F44531, 00F44536
removable, xrefs: 00F445EA, 00F445EF
network, xrefs: 00F4469D, 00F446A2
unknown, xrefs: 00F44708
ramdisk, xrefs: 00F446F1
cdrom, xrefs: 00F4458F, 00F44594

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 1ed50d2644b24ba6691015a135ff2501379b432ea6239faca09053d6a59aa6af
Instruction ID: 6120e09cb9b0e373f7a5d7e48a60bc90a61b0e7615c87ab9a2ce44657772c59a
Opcode Fuzzy Hash: 1ed50d2644b24ba6691015a135ff2501379b432ea6239faca09053d6a59aa6af
Instruction Fuzzy Hash: F6B1D171A083029BC710DF28C890B6ABBE5FFA5760F54491DF896E7291E730E845DA92

Function 00F53FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F6CC08), ref: 00F540BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F540CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00F6CC08), ref: 00F540F2
FreeLibrary.KERNEL32(00000000,?,00F6CC08), ref: 00F5413E
StringFromGUID2.OLE32(?,?,00000028,?,00F6CC08), ref: 00F541A8
SysFreeString.OLEAUT32(00000009), ref: 00F54262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F542C8
SysFreeString.OLEAUT32(?), ref: 00F542F2

Strings

GetModuleHandleExW, xrefs: 00F540C7
kernel32.dll, xrefs: 00F540B6

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 3fd0d6ba4a9111c2a6166ff2e83f4c0e2998dfe652bcc8fb7708d4dd8213d572
Instruction ID: 59b6e78d9d24cca8b5d9a0b384e18a7d2302cd34f16b7dfe26f5fa1f273ee28a
Opcode Fuzzy Hash: 3fd0d6ba4a9111c2a6166ff2e83f4c0e2998dfe652bcc8fb7708d4dd8213d572
Instruction Fuzzy Hash: D9125E71A00119EFDB14CF94C884EAEBBB5FF45319F248098EA459B261D731FD86DBA0

Function 00ED326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00FA1990), ref: 00F12F8D
GetMenuItemCount.USER32(00FA1990), ref: 00F1303D
GetCursorPos.USER32(?), ref: 00F13081
SetForegroundWindow.USER32(00000000), ref: 00F1308A
TrackPopupMenuEx.USER32(00FA1990,00000000,?,00000000,00000000,00000000), ref: 00F1309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F130A9

Strings

0, xrefs: 00ED327D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: f81a72acbff591c4c86e0e9dd83a49333256c0a24c916d4c2d3a7eb30d4d32d0
Instruction ID: 5be93fe1da513a440d94f39779d28c6988f8efc9b4e239624a9625e099b02ca7
Opcode Fuzzy Hash: f81a72acbff591c4c86e0e9dd83a49333256c0a24c916d4c2d3a7eb30d4d32d0
Instruction Fuzzy Hash: 99712C71A44209BEEB218F64CC49FEABF64FF04374F104206F5256A1E0C7B1AD60EB91

Function 00F66CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00F66DEB

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F66E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F66E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F66E94
DestroyWindow.USER32(?), ref: 00F66EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00ED0000,00000000), ref: 00F66EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F66EFD
GetDesktopWindow.USER32 ref: 00F66F16
GetWindowRect.USER32(00000000), ref: 00F66F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F66F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F66F4D

Part of subcall function 00EE9944: GetWindowLongW.USER32(?,000000EB), ref: 00EE9952

Strings

tooltips_class32, xrefs: 00F66E58, 00F66EDD
0, xrefs: 00F66D98

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: eeb6990b4d05e7793ca6d189b8a06d1e037b0d45e5c39641b1435f04ae9b1d0d
Instruction ID: dcc9e1d808d33b971503c88aec0dc2608658658003b846215eb9e82e2e33ca7f
Opcode Fuzzy Hash: eeb6990b4d05e7793ca6d189b8a06d1e037b0d45e5c39641b1435f04ae9b1d0d
Instruction Fuzzy Hash: 24718670504248AFEB20CF18D844FBABBE9FB99314F04041EF999C7261D771E906EB56

Function 00F6911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

DragQueryPoint.SHELL32(?,?), ref: 00F69147

Part of subcall function 00F67674: ClientToScreen.USER32(?,?), ref: 00F6769A
Part of subcall function 00F67674: GetWindowRect.USER32(?,?), ref: 00F67710
Part of subcall function 00F67674: PtInRect.USER32(?,?,00F68B89), ref: 00F67720

SendMessageW.USER32(?,000000B0,?,?), ref: 00F691B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F691BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F691DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F69225
SendMessageW.USER32(?,000000B0,?,?), ref: 00F6923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00F69255
SendMessageW.USER32(?,000000B1,?,?), ref: 00F69277
DragFinish.SHELL32(?), ref: 00F6927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F69371

Strings

@GUI_DRAGFILE, xrefs: 00F69320
@GUI_DRAGID, xrefs: 00F692E9
@GUI_DROPID, xrefs: 00F6929E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: b6e868ff4374c89e6bb12cf6f9082519ea493409d16c5e6ba44b9aeb1218858c
Instruction ID: fa8eaaaa3e3af55734ae0d71b7dfb550acdcb81d031c1220e95ba4297398e3dd
Opcode Fuzzy Hash: b6e868ff4374c89e6bb12cf6f9082519ea493409d16c5e6ba44b9aeb1218858c
Instruction Fuzzy Hash: EA618C71108305AFD701EF60DC85DAFBBE8EF89750F10091EF5A5A32A1DB709A49DB92

Function 00F4C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F4C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00F4C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00F4C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00F4C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00F4C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00F4C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F4C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F4C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00F4C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00F4C5F0
InternetCloseHandle.WININET(00000000), ref: 00F4C5FB

Strings

, xrefs: 00F4C575

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: c9c1ac44113580ab6e099c32fbad9d5df4205e9a7ca0f57632f3ad77e91622df
Instruction ID: 8dc34aee79f9dd4f40cbecf82b2cf436e56ed6476741bda4db044681d44ed889
Opcode Fuzzy Hash: c9c1ac44113580ab6e099c32fbad9d5df4205e9a7ca0f57632f3ad77e91622df
Instruction Fuzzy Hash: 6E516DB1501208BFDB619F60C948ABB7FFCFF08754F049419F99596210EB74E944ABA0

Function 00F6856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00F68592
GetFileSize.KERNEL32(00000000,00000000), ref: 00F685A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00F685AD
CloseHandle.KERNEL32(00000000), ref: 00F685BA
GlobalLock.KERNEL32(00000000), ref: 00F685C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F685D7
GlobalUnlock.KERNEL32(00000000), ref: 00F685E0
CloseHandle.KERNEL32(00000000), ref: 00F685E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00F685F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00F6FC38,?), ref: 00F68611
GlobalFree.KERNEL32(00000000), ref: 00F68621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00F68641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00F68671
DeleteObject.GDI32(00000000), ref: 00F68699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F686AF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 4960ab8701eeeafe0e783caeee38debc78363fb7bda9aea9ee95b7c3ee120883
Instruction ID: 89825812c10b30f43f621bccc3e10db59b18d6d4050d63204810ebef9841b7bd
Opcode Fuzzy Hash: 4960ab8701eeeafe0e783caeee38debc78363fb7bda9aea9ee95b7c3ee120883
Instruction Fuzzy Hash: 61416C71600208AFDB10DFA5CC48EBA7BB8FF89761F004119F996E7260DB719D01EB60

Function 00F414BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00F41502
VariantCopy.OLEAUT32(?,?), ref: 00F4150B
VariantClear.OLEAUT32(?), ref: 00F41517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00F415FB
VarR8FromDec.OLEAUT32(?,?), ref: 00F41657
VariantInit.OLEAUT32(?), ref: 00F41708
SysFreeString.OLEAUT32(?), ref: 00F4178C
VariantClear.OLEAUT32(?), ref: 00F417D8
VariantClear.OLEAUT32(?), ref: 00F417E7
VariantInit.OLEAUT32(00000000), ref: 00F41823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00F41625
Default, xrefs: 00F416AF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 8453f6d63d5b25b7d719ef37752a2d64dae2f2feb35d373a178d7737c7a9879b
Instruction ID: d0f99cfd6c8738795dcbb37fa77eb612752162c3458b33ddb9aaa8604492d6cd
Opcode Fuzzy Hash: 8453f6d63d5b25b7d719ef37752a2d64dae2f2feb35d373a178d7737c7a9879b
Instruction Fuzzy Hash: 95D1D332A00119DBDB10EF65D885BB9BBF5FF44700F188156E846AB281DB74EC85EBA1

Function 00F5B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F5C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F5B6AE,?,?), ref: 00F5C9B5
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5C9F1
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA68
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F5B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F5B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00F5B80A
RegCloseKey.ADVAPI32(?), ref: 00F5B87E
RegCloseKey.ADVAPI32(?), ref: 00F5B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00F5B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F5B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00F5B922
FreeLibrary.KERNEL32(00000000), ref: 00F5B983
RegCloseKey.ADVAPI32(00000000), ref: 00F5B994

Strings

advapi32.dll, xrefs: 00F5B8ED
RegDeleteKeyExW, xrefs: 00F5B8FE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: c2aefa1871da71e64476ec4d36859b146f1272bf3f8fcdd67e3bb6d6e786f0e2
Instruction ID: 591869343b57793529e6876d37b1fd197a45d074e580dd23ea3c317fae00bb32
Opcode Fuzzy Hash: c2aefa1871da71e64476ec4d36859b146f1272bf3f8fcdd67e3bb6d6e786f0e2
Instruction Fuzzy Hash: 9CC18C30604201AFD710DF14C495F2ABBE1FF84319F18949DE99A9B3A2CB71EC4ADB91

Function 00F5255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F525D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00F525E8
CreateCompatibleDC.GDI32(?), ref: 00F525F4
SelectObject.GDI32(00000000,?), ref: 00F52601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00F5266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00F526AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00F526D0
SelectObject.GDI32(?,?), ref: 00F526D8
DeleteObject.GDI32(?), ref: 00F526E1
DeleteDC.GDI32(?), ref: 00F526E8
ReleaseDC.USER32(00000000,?), ref: 00F526F3

Strings

(, xrefs: 00F5268D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 389d75eda5e62de0318c276ecb71186fcabad34f9013132d902bf5f6a866f9df
Instruction ID: e35da207354a059ff5be93f9a82f0134fe8eaf4053ff8ae8e363e70f58ececc8
Opcode Fuzzy Hash: 389d75eda5e62de0318c276ecb71186fcabad34f9013132d902bf5f6a866f9df
Instruction Fuzzy Hash: 5261E275D00219EFCF04CFA8D984AAEBBF5FF48310F20852AEA95A7250D774A941DF90

Function 00F0DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F0DAA1

Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D659
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D66B
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D67D
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D68F
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D6A1
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D6B3
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D6C5
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D6D7
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D6E9
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D6FB
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D70D
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D71F
Part of subcall function 00F0D63C: _free.LIBCMT ref: 00F0D731

_free.LIBCMT ref: 00F0DA96

Part of subcall function 00F029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000), ref: 00F029DE
Part of subcall function 00F029C8: GetLastError.KERNEL32(00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000,00000000), ref: 00F029F0

_free.LIBCMT ref: 00F0DAB8
_free.LIBCMT ref: 00F0DACD
_free.LIBCMT ref: 00F0DAD8
_free.LIBCMT ref: 00F0DAFA
_free.LIBCMT ref: 00F0DB0D
_free.LIBCMT ref: 00F0DB1B
_free.LIBCMT ref: 00F0DB26
_free.LIBCMT ref: 00F0DB5E
_free.LIBCMT ref: 00F0DB65
_free.LIBCMT ref: 00F0DB82
_free.LIBCMT ref: 00F0DB9A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 40e298aab359105e97d9de93dfc1f824852cffcb8b8b17c664c5d412436e23b4
Instruction ID: 84ce9fade3f582fe4ff27133483d01ec8b776bff6dda228a217218dec167dd46
Opcode Fuzzy Hash: 40e298aab359105e97d9de93dfc1f824852cffcb8b8b17c664c5d412436e23b4
Instruction Fuzzy Hash: 1E314A71A042059FEB61AAB9EC49B5AB7E9FF40320F654419E449D71D2DB39EC80FB20

Function 00F3365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F3369C
_wcslen.LIBCMT ref: 00F336A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F33797
GetClassNameW.USER32(?,?,00000400), ref: 00F3380C
GetDlgCtrlID.USER32(?), ref: 00F3385D
GetWindowRect.USER32(?,?), ref: 00F33882
GetParent.USER32(?), ref: 00F338A0
ScreenToClient.USER32(00000000), ref: 00F338A7
GetClassNameW.USER32(?,?,00000100), ref: 00F33921
GetWindowTextW.USER32(?,?,00000400), ref: 00F3395D

Strings

%s%u, xrefs: 00F33734

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 980daacfe5c71e003227bef54d9236806a84a70bef3bf41f2ed545e517a1fee8
Instruction ID: 40251ee399b07277f13f5800ec3b69b7933d4332624e630de39adafe89873495
Opcode Fuzzy Hash: 980daacfe5c71e003227bef54d9236806a84a70bef3bf41f2ed545e517a1fee8
Instruction Fuzzy Hash: A991C171605606EFD718DF24C885FBAF7A9FF44320F008629FA99D2190DB70EA45DBA1

Function 00F34954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00F34994
GetWindowTextW.USER32(?,?,00000400), ref: 00F349DA
_wcslen.LIBCMT ref: 00F349EB
CharUpperBuffW.USER32(?,00000000), ref: 00F349F7
_wcsstr.LIBVCRUNTIME ref: 00F34A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00F34A64
GetWindowTextW.USER32(?,?,00000400), ref: 00F34A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00F34AE6
GetClassNameW.USER32(?,?,00000400), ref: 00F34B20
GetWindowRect.USER32(?,?), ref: 00F34B8B

Strings

ThumbnailClass, xrefs: 00F34A6F, 00F34AF1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 98d1d1f972952808795c402fb978e4f44dfc6d934234a59b44cb9f733f65d02c
Instruction ID: 3daf244ba3fad6506092bef0a2059ad5512a59b44a2b4f31596d5aff6f300d9a
Opcode Fuzzy Hash: 98d1d1f972952808795c402fb978e4f44dfc6d934234a59b44cb9f733f65d02c
Instruction Fuzzy Hash: E691BE325082099FDB04CF14C981BAAB7E8FF84374F04846AFD859A196DB74FD45EBA1

Function 00F3BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00FA1990,000000FF,00000000,00000030), ref: 00F3BFAC
SetMenuItemInfoW.USER32(00FA1990,00000004,00000000,00000030), ref: 00F3BFE1
Sleep.KERNEL32(000001F4), ref: 00F3BFF3
GetMenuItemCount.USER32(?), ref: 00F3C039
GetMenuItemID.USER32(?,00000000), ref: 00F3C056
GetMenuItemID.USER32(?,-00000001), ref: 00F3C082
GetMenuItemID.USER32(?,?), ref: 00F3C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F3C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F3C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F3C145

Strings

0, xrefs: 00F3BF3D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 27f80c61655c3759e1e6975a1de6fe3b0e28fb42636c3f20b2e7651d00c8eeb3
Instruction ID: 7b48e475634a651aef54a5b409920e6fbf8d0c14d67205c8e177f02dd8dace01
Opcode Fuzzy Hash: 27f80c61655c3759e1e6975a1de6fe3b0e28fb42636c3f20b2e7651d00c8eeb3
Instruction Fuzzy Hash: 20619DB190028AEFDF15DF64CD88ABEBBB8EB05364F044115E991B3291C775AD04EBA0

Function 00F5CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00F5CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00F5CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00F5CD48

Part of subcall function 00F5CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00F5CCAA
Part of subcall function 00F5CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00F5CCBD
Part of subcall function 00F5CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F5CCCF
Part of subcall function 00F5CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00F5CD05
Part of subcall function 00F5CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00F5CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00F5CCF3

Strings

advapi32.dll, xrefs: 00F5CCB8
RegDeleteKeyExW, xrefs: 00F5CCC9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: ce10619d0170f7393e3339c8aa27c65d4079f2ca99d77fcb157de7a8fd18a1c4
Instruction ID: 7ff30c0524f7fee41c70c12529ebfcea2ff52f9f965101662a4ac6cca0ef6ed0
Opcode Fuzzy Hash: ce10619d0170f7393e3339c8aa27c65d4079f2ca99d77fcb157de7a8fd18a1c4
Instruction Fuzzy Hash: AB318071D0122CBFDB219B90DC88EFFBB7CEF05751F000165EA56E2141D6B49A49BAE0

Function 00F43D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F43D40
_wcslen.LIBCMT ref: 00F43D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F43D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F43DBE
RemoveDirectoryW.KERNEL32(?), ref: 00F43DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F43E55
CloseHandle.KERNEL32(00000000), ref: 00F43E60
CloseHandle.KERNEL32(00000000), ref: 00F43E6B

Strings

:, xrefs: 00F43D82
\??\%s, xrefs: 00F43D5B
\, xrefs: 00F43D77

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: c220bdc7a2f816d982e05bd9b0987d6d386b4771d97414da861fb4e26ff80093
Instruction ID: 64bedcdeeaa3e7a689209b741a1476016f8c1c2057d99e1459c9a655665a97d8
Opcode Fuzzy Hash: c220bdc7a2f816d982e05bd9b0987d6d386b4771d97414da861fb4e26ff80093
Instruction Fuzzy Hash: 2631A17290020DABDB209BA0DC49FEF3BBCEF89710F1041A5FA55E6160E7B497449B64

Function 00F3E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F3E6B4

Part of subcall function 00EEE551: timeGetTime.WINMM(?,?,00F3E6D4), ref: 00EEE555

Sleep.KERNEL32(0000000A), ref: 00F3E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00F3E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F3E727
SetActiveWindow.USER32 ref: 00F3E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F3E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00F3E773
Sleep.KERNEL32(000000FA), ref: 00F3E77E
IsWindow.USER32 ref: 00F3E78A
EndDialog.USER32(00000000), ref: 00F3E79B

Strings

BUTTON, xrefs: 00F3E719

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 9021e6f6829c1721c9449b33d6bcf78cb23845dbb59ed6d9249de1e19e660ed3
Instruction ID: 29e7c7a98f082a8d64e6812c9bfe4cdd3b40b6a14ad525c3450c3cbba36fe39d
Opcode Fuzzy Hash: 9021e6f6829c1721c9449b33d6bcf78cb23845dbb59ed6d9249de1e19e660ed3
Instruction Fuzzy Hash: A221A1B034020DAFEF005F64EC99A363B69FF56368F000425F4A6826E1DBB1AC00BB64

Function 00F3E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F3EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F3EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F3EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F3EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F3EAA7

Strings

open , xrefs: 00F3EA0C
close PlayMe, xrefs: 00F3EA6E, 00F3EA9B
play PlayMe, xrefs: 00F3EAA2
play PlayMe wait, xrefs: 00F3EA91
alias PlayMe, xrefs: 00F3EA36
status PlayMe mode, xrefs: 00F3EA58

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 957b38f97de2a32242ea58a0241c490f805adfa67cf19961b04c7cdeeab9d0db
Instruction ID: 8380a5f31272e90f9991965c772f7eb14d96977418f9fa658cc76bede16034f3
Opcode Fuzzy Hash: 957b38f97de2a32242ea58a0241c490f805adfa67cf19961b04c7cdeeab9d0db
Instruction Fuzzy Hash: 4C117731A5025979EB20A7A2DC4AEFF6ABCEFD1B50F0004267411E21D1DE709D06D5B1

Function 00F39F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F3A012
SetKeyboardState.USER32(?), ref: 00F3A07D
GetAsyncKeyState.USER32(000000A0), ref: 00F3A09D
GetKeyState.USER32(000000A0), ref: 00F3A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00F3A0E3
GetKeyState.USER32(000000A1), ref: 00F3A0F4
GetAsyncKeyState.USER32(00000011), ref: 00F3A120
GetKeyState.USER32(00000011), ref: 00F3A12E
GetAsyncKeyState.USER32(00000012), ref: 00F3A157
GetKeyState.USER32(00000012), ref: 00F3A165
GetAsyncKeyState.USER32(0000005B), ref: 00F3A18E
GetKeyState.USER32(0000005B), ref: 00F3A19C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6619137477c1c2bfff4f985a702edc3e9485f6f36904f5cdd6d1c29751893752
Instruction ID: 665e771a5f333d494015e7e81888575002ca2302359705c6d66b1c3619af9f1f
Opcode Fuzzy Hash: 6619137477c1c2bfff4f985a702edc3e9485f6f36904f5cdd6d1c29751893752
Instruction Fuzzy Hash: E051DA30E0878829FB35EB7188157EABFF49F123B0F08459DD5C2571C2DA94AA4CDB62

Function 00F35CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00F35CE2
GetWindowRect.USER32(00000000,?), ref: 00F35CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00F35D59
GetDlgItem.USER32(?,00000002), ref: 00F35D69
GetWindowRect.USER32(00000000,?), ref: 00F35D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00F35DCF
GetDlgItem.USER32(?,000003E9), ref: 00F35DDD
GetWindowRect.USER32(00000000,?), ref: 00F35DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00F35E31
GetDlgItem.USER32(?,000003EA), ref: 00F35E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F35E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00F35E67

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 72142b544c2140725a16b494a88fedf975e3216b3521d85aa25deaa650fc07f0
Instruction ID: 32675862a2494f680a7a39286180e61d6cb093e187c08e8694eb90f8063ba854
Opcode Fuzzy Hash: 72142b544c2140725a16b494a88fedf975e3216b3521d85aa25deaa650fc07f0
Instruction Fuzzy Hash: 1A511FB1F00609AFDF18CF68CD89AAE7BB5EB88711F108129F555E7290D7B09E00DB60

Function 00EE8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EE8BE8,?,00000000,?,?,?,?,00EE8BBA,00000000,?), ref: 00EE8FC5

DestroyWindow.USER32(?), ref: 00EE8C81
KillTimer.USER32(00000000,?,?,?,?,00EE8BBA,00000000,?), ref: 00EE8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00F26973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00EE8BBA,00000000,?), ref: 00F269A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00EE8BBA,00000000,?), ref: 00F269B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00EE8BBA,00000000), ref: 00F269D4
DeleteObject.GDI32(00000000), ref: 00F269E6

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 03aa2687ac957ad79c8c9fefb52f3fa2f5743cb5522013c97b891e3588cbef10
Instruction ID: 9a4a6a9b7d298f313ecc79d838ee20088498f98ed8dd130f252d7369ec15fac2
Opcode Fuzzy Hash: 03aa2687ac957ad79c8c9fefb52f3fa2f5743cb5522013c97b891e3588cbef10
Instruction Fuzzy Hash: B761EF7050265CDFDB219F16DA48B26B7F1FF06326F20651DE086A7560CB75AC80EF91

Function 00EE9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9944: GetWindowLongW.USER32(?,000000EB), ref: 00EE9952

GetSysColor.USER32(0000000F), ref: 00EE9862

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f6629c5ebd4551039d42395cd5c40753f9c134cf1beab1f5af2299e1059472a2
Instruction ID: 8f4126348b6487308d4fd5ca64cc50d152525a29a29890a6877284c2c3de060b
Opcode Fuzzy Hash: f6629c5ebd4551039d42395cd5c40753f9c134cf1beab1f5af2299e1059472a2
Instruction Fuzzy Hash: FB41E031100698AFDB245F399C84BB93BA5AB06330F185605F9F2972F2D3719C41EB51

Function 00F08D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

., xrefs: 00F0903A, 00F08FD0, 00F08FF2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-3963672497
Opcode ID: c0f35ad261ebefe19991f69f253a248989528190f00f0667f42ce0553fe57774
Instruction ID: e7cd8e08e24b364f28129ddec44ab507244b2e3301fd1ebfcb9860bdb16038ad
Opcode Fuzzy Hash: c0f35ad261ebefe19991f69f253a248989528190f00f0667f42ce0553fe57774
Instruction Fuzzy Hash: E4C1E2B5E08249AFDB11DFA8DC41BADBBB0AF49320F044159F554A73D2DB748942FB60

Function 00F396E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00F1F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00F39717
LoadStringW.USER32(00000000,?,00F1F7F8,00000001), ref: 00F39720

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00F1F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00F39742
LoadStringW.USER32(00000000,?,00F1F7F8,00000001), ref: 00F39745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00F39866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F3984A
Line %d (File "%s"):, xrefs: 00F3978F
^ ERROR, xrefs: 00F397FB
Error: , xrefs: 00F3981D
Line %d:, xrefs: 00F397A0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 0128a1760ebb59104a16d619d72cdead3fbde267a5931d190ffd3d6b22551b26
Instruction ID: 0dae84acc7168d03cbc8a205d919e744213e6318532a44962e5f040dc75801d1
Opcode Fuzzy Hash: 0128a1760ebb59104a16d619d72cdead3fbde267a5931d190ffd3d6b22551b26
Instruction Fuzzy Hash: 0C417272904209AADF04FBE0DE42DEEB3B8EF55740F501026F10172192EB756F49DB61

Function 00F306DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F307A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F307BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F307DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F30804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00F3082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F30837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F3083C

Strings

\CLSID, xrefs: 00F30724
SOFTWARE\Classes\, xrefs: 00F3070E
\IPC$, xrefs: 00F30784

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: db4e2928eceb245e703f7d4c7633f987fc860ed84419db75cedbca717d8d4899
Instruction ID: c2ffd57526a2427f240fc5bda567b8e5b281166c0e9af154e3bd397d73669108
Opcode Fuzzy Hash: db4e2928eceb245e703f7d4c7633f987fc860ed84419db75cedbca717d8d4899
Instruction Fuzzy Hash: E6412676C0022DABDF15EBA4DC958EDB7B8FF04750F04412AE951B72A1EB709E05DBA0

Function 00F63F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F6403B
CreateCompatibleDC.GDI32(00000000), ref: 00F64042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F64055
SelectObject.GDI32(00000000,00000000), ref: 00F6405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F64068
DeleteDC.GDI32(00000000), ref: 00F64072
GetWindowLongW.USER32(?,000000EC), ref: 00F6407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00F64092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00F6409E

Strings

static, xrefs: 00F63FD3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 858e873539f09cc59d5b15c76a20c0fa8289cc52e3a1dfed7a981a1f1fa983b8
Instruction ID: d0d96cc6837cfcbce609b1a9c93ee6d8bb080bafb00072f57ea2214d491b1f31
Opcode Fuzzy Hash: 858e873539f09cc59d5b15c76a20c0fa8289cc52e3a1dfed7a981a1f1fa983b8
Instruction Fuzzy Hash: 3B316132501219BBDF219FA4CC05FEA3B69FF0D360F110215FAA9E61A1C775D851EBA4

Function 00F53C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F53C5C
CoInitialize.OLE32(00000000), ref: 00F53C8A
CoUninitialize.OLE32 ref: 00F53C94
_wcslen.LIBCMT ref: 00F53D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00F53DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00F53ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00F53F0E
CoGetObject.OLE32(?,00000000,00F6FB98,?), ref: 00F53F2D
SetErrorMode.KERNEL32(00000000), ref: 00F53F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F53FC4
VariantClear.OLEAUT32(?), ref: 00F53FD8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 1fb61a956d0ca4bcaea9c328a74695a3c83502959aa8d4d91c413f3344a0d84d
Instruction ID: 114f58afb4fc0bfeca98d7a2c47e598502c6366b468decd9638541383b463e86
Opcode Fuzzy Hash: 1fb61a956d0ca4bcaea9c328a74695a3c83502959aa8d4d91c413f3344a0d84d
Instruction Fuzzy Hash: CAC136716082059FC700DF68C88492BB7F9FF89795F00491DFA899B251DB71EE09DB92

Function 00F47A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F47AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F47B8F
SHGetDesktopFolder.SHELL32(?), ref: 00F47BA3
CoCreateInstance.OLE32(00F6FD08,00000000,00000001,00F96E6C,?), ref: 00F47BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F47C74
CoTaskMemFree.OLE32(?,?), ref: 00F47CCC
SHBrowseForFolderW.SHELL32(?), ref: 00F47D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F47D7A
CoTaskMemFree.OLE32(00000000), ref: 00F47D81
CoTaskMemFree.OLE32(00000000), ref: 00F47DD6
CoUninitialize.OLE32 ref: 00F47DDC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: f2e45497b9429ea34ce65531e6a9de658073eca751c4b8527349c30b3f1b5251
Instruction ID: 1b726b75ec19f8071e8f34ff4b796efb967283cfbbef957801d15212787a6683
Opcode Fuzzy Hash: f2e45497b9429ea34ce65531e6a9de658073eca751c4b8527349c30b3f1b5251
Instruction Fuzzy Hash: BAC14C75A04209AFCB14DFA4C884DAEBBF9FF48314B148499E859EB361D730ED41DB90

Function 00F6541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F65504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F65515
CharNextW.USER32(00000158), ref: 00F65544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F65585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F6559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F655AC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a6da4af2a7f02c0fe65cb79cc7a3f2c3e83b851e4d2ff1b2897f44366c41f919
Instruction ID: 1f458816524028b63d9eff41fd1316efca6882ccb948cbe0c21f132c0eb58650
Opcode Fuzzy Hash: a6da4af2a7f02c0fe65cb79cc7a3f2c3e83b851e4d2ff1b2897f44366c41f919
Instruction Fuzzy Hash: 69619D71900609ABDF10DF64CC84AFE7BB9EB09B34F144145F965BA291DB758A80EB60

Function 00F2FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F2FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00F2FB08
VariantInit.OLEAUT32(?), ref: 00F2FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00F2FB3A
VariantCopy.OLEAUT32(?,?), ref: 00F2FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00F2FBA1
VariantClear.OLEAUT32(?), ref: 00F2FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00F2FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F2FBCC
VariantClear.OLEAUT32(?), ref: 00F2FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F2FBE9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 34e4f19fe0f8d8cda6360540d702622b35957d4405d3968b08734399a7f02e35
Instruction ID: b52375f5a68a65eaaf2443bc8c4a3765c1d68344958be0d8bf6fb81f0877678a
Opcode Fuzzy Hash: 34e4f19fe0f8d8cda6360540d702622b35957d4405d3968b08734399a7f02e35
Instruction Fuzzy Hash: 29413E35A1021A9FCB00DF64DC589AEBBB9EF48354F008079E996A7261CB74A945DFA0

Function 00F39C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F39CA1
GetAsyncKeyState.USER32(000000A0), ref: 00F39D22
GetKeyState.USER32(000000A0), ref: 00F39D3D
GetAsyncKeyState.USER32(000000A1), ref: 00F39D57
GetKeyState.USER32(000000A1), ref: 00F39D6C
GetAsyncKeyState.USER32(00000011), ref: 00F39D84
GetKeyState.USER32(00000011), ref: 00F39D96
GetAsyncKeyState.USER32(00000012), ref: 00F39DAE
GetKeyState.USER32(00000012), ref: 00F39DC0
GetAsyncKeyState.USER32(0000005B), ref: 00F39DD8
GetKeyState.USER32(0000005B), ref: 00F39DEA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 07cbe357ee7449d703831dacd0069eb3be3a7df602b3fa8c067ecb1f43b2b252
Instruction ID: 69d80b6ac807401ee90faf534a599216bfa5816165a5e9f170294913594acf86
Opcode Fuzzy Hash: 07cbe357ee7449d703831dacd0069eb3be3a7df602b3fa8c067ecb1f43b2b252
Instruction Fuzzy Hash: 4C41A734D0C7CA69FF31976488053B6BEA06F11374F08805ADAC6566C2DBE59DC4EBA2

Function 00F5055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F505BC
inet_addr.WSOCK32(?), ref: 00F5061C
gethostbyname.WSOCK32(?), ref: 00F50628
IcmpCreateFile.IPHLPAPI ref: 00F50636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F506C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F506E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00F507B9
WSACleanup.WSOCK32 ref: 00F507BF

Strings

Ping, xrefs: 00F50676

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 2e6598ba37b33839166d1b73e5fb58b14ab77e40cb071fa5def3869cfe80b667
Instruction ID: 8eed404ce0d2b5e816890d54f5a461674dac9e74197f431279a776afd81b7dcb
Opcode Fuzzy Hash: 2e6598ba37b33839166d1b73e5fb58b14ab77e40cb071fa5def3869cfe80b667
Instruction Fuzzy Hash: 0291A075A042019FD320CF15D488F16BBE0EF48328F1485A9F9A99B7A2DB70ED49DF81

Function 00F58CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00F58CF3

Part of subcall function 00F38E54: _wcslen.LIBCMT ref: 00F38E77

_wcslen.LIBCMT ref: 00F58D4E
_wcslen.LIBCMT ref: 00F58D9C
_wcslen.LIBCMT ref: 00F58DDC
_wcslen.LIBCMT ref: 00F58E6E

Strings

cdecl, xrefs: 00F58D48, 00F58D4D
winapi, xrefs: 00F58D96, 00F58D9B
stdcall, xrefs: 00F58DD6, 00F58DDB
none, xrefs: 00F58E65, 00F58E6A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 7764294d0ceea4ce298c21b0c3e8b4a7b03e72c0f8e48e1b1b9fa2415966d1b6
Instruction ID: ff8bb82d76873f97cd513c28ad80fcbbd340f32ff4da5045f8a848d430cfa982
Opcode Fuzzy Hash: 7764294d0ceea4ce298c21b0c3e8b4a7b03e72c0f8e48e1b1b9fa2415966d1b6
Instruction Fuzzy Hash: 5B51C332A001169BCF14DFA8C8415BEB7F1AF643A1B204229EA66F72C1DB31DD46E790

Function 00F5372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00F53774
CoUninitialize.OLE32 ref: 00F5377F
CoCreateInstance.OLE32(?,00000000,00000017,00F6FB78,?), ref: 00F537D9
IIDFromString.OLE32(?,?), ref: 00F5384C
VariantInit.OLEAUT32(?), ref: 00F538E4
VariantClear.OLEAUT32(?), ref: 00F53936

Strings

Invalid parameter, xrefs: 00F53865
NULL Pointer assignment, xrefs: 00F5381E
Failed to create object, xrefs: 00F537E4, 00F5389A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 9517fce51cebcf2e4e419feadf55fd025ae8dc478ed44188215443ea5127d2b0
Instruction ID: ed8e89decbf0f02d20df056352c36777665ed3cb86787042be9d6bee3b767862
Opcode Fuzzy Hash: 9517fce51cebcf2e4e419feadf55fd025ae8dc478ed44188215443ea5127d2b0
Instruction Fuzzy Hash: 7861B371608301AFD311DF68D849F6ABBE4EF48756F100909FA859B291D770EE48EB92

Function 00F43388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00F433CF

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00F433F0

Strings

Incorrect parameters to object property !, xrefs: 00F434AB
Line %d (File "%s"):, xrefs: 00F43443, 00F4345C
Error: , xrefs: 00F434D1
"%s" (%d) : ==> %s:, xrefs: 00F43522
^ ERROR , xrefs: 00F4349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00F43504

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 1514f44c86eb3fcf8cdea8129bc82afb1a23ef4fac7f81f1ba9981a54becad55
Instruction ID: ff0e1183209b57a226a3a1d14daf2155a668b27974ee9987c88f0e9a37d06fcb
Opcode Fuzzy Hash: 1514f44c86eb3fcf8cdea8129bc82afb1a23ef4fac7f81f1ba9981a54becad55
Instruction Fuzzy Hash: 8251B172D00209AADF14EBE0DD42EEEB7B8EF14340F144066F405721A2EB756F59EB61

Function 00F3B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F3B5FC
_wcslen.LIBCMT ref: 00F3B608
_wcslen.LIBCMT ref: 00F3B64D
_wcslen.LIBCMT ref: 00F3B68C
_wcslen.LIBCMT ref: 00F3B6C7

Strings

KEYS, xrefs: 00F3B647, 00F3B64C
APPEND, xrefs: 00F3B6C1, 00F3B6C6
EXISTS, xrefs: 00F3B686, 00F3B68B
REMOVE, xrefs: 00F3B602, 00F3B607

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 316f193f17759bd7afb1ab74a47e6841fe7abc5a59a586b77ddec909d1e21271
Instruction ID: 840894c791ce88323bcd29b35966bd204f878e0b37e5084d3a66215db7b6a6e2
Opcode Fuzzy Hash: 316f193f17759bd7afb1ab74a47e6841fe7abc5a59a586b77ddec909d1e21271
Instruction Fuzzy Hash: E841E832E0002B9BCB105F7DC8A15BE77A5EFA0774F244169E625DB286E731CD81E790

Function 00F45393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F453A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F45416
GetLastError.KERNEL32 ref: 00F45420
SetErrorMode.KERNEL32(00000000,READY), ref: 00F454A7

Strings

NOTREADY, xrefs: 00F4544B
UNKNOWN, xrefs: 00F45444
READONLY, xrefs: 00F45452
INVALID, xrefs: 00F45459
READY, xrefs: 00F45460, 00F45468

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: b18aa1f29d74896505efd5723522d88b92c023c6c4bbf9ad30068e992edd49dc
Instruction ID: b719162c5d40e89d333d7ce1d586cd3c4e7e8d0b9d17692870b521e2dd48ffa1
Opcode Fuzzy Hash: b18aa1f29d74896505efd5723522d88b92c023c6c4bbf9ad30068e992edd49dc
Instruction Fuzzy Hash: 4231C035A001089FDB10EF68C894BAABBB4EF05715F148066E805DF3A3DB75DD82EB90

Function 00F63C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00F63C79
SetMenu.USER32(?,00000000), ref: 00F63C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F63D10
IsMenu.USER32(?), ref: 00F63D24
CreatePopupMenu.USER32 ref: 00F63D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F63D5B
DrawMenuBar.USER32 ref: 00F63D63

Strings

0, xrefs: 00F63C54
F, xrefs: 00F63D4E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 3e473dcd530080b8e5ff351fc761225ebbd5db22d55c1e87fb0e4c96223a0bc5
Instruction ID: d06974b1c669787d720c46374e6a086fba88734b90c71e2ac9fa38bb578b4dd0
Opcode Fuzzy Hash: 3e473dcd530080b8e5ff351fc761225ebbd5db22d55c1e87fb0e4c96223a0bc5
Instruction Fuzzy Hash: 7F415979A01209AFDB14CF64DC44AAA7BB5FF49350F180029FA96A7360D770AE10EF94

Function 00F31EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00F31F64
GetDlgCtrlID.USER32 ref: 00F31F6F
GetParent.USER32 ref: 00F31F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F31F8E
GetDlgCtrlID.USER32(?), ref: 00F31F97
GetParent.USER32(?), ref: 00F31FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F31FAE

Strings

ComboBox, xrefs: 00F31EEC
ListBox, xrefs: 00F31F21

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 10c1a19115df4b5ef701bab0ea087f564cd480f0b032e4808eabba1a4e96db2c
Instruction ID: d48722d6d471d44ef1a6b7993467efc19aaa9ed1cfe1f0ec409d6a31dfeefab9
Opcode Fuzzy Hash: 10c1a19115df4b5ef701bab0ea087f564cd480f0b032e4808eabba1a4e96db2c
Instruction Fuzzy Hash: 6521F574D00118BBCF04AFA0DC44DFEBBB4EF05360F105106F9A567292CB794905EB60

Function 00F31FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00F32043
GetDlgCtrlID.USER32 ref: 00F3204E
GetParent.USER32 ref: 00F3206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F3206D
GetDlgCtrlID.USER32(?), ref: 00F32076
GetParent.USER32(?), ref: 00F3208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F3208D

Strings

ComboBox, xrefs: 00F31FCD
ListBox, xrefs: 00F32002

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 9ed6d1eb9c10bbde09879cd09b3dfe8b8e8b0162fe1ea44d546caa0b355d3551
Instruction ID: f9357cd3a26dc938682192c3d1acbcc099f2b719e109d27f06e99fe07164dbe6
Opcode Fuzzy Hash: 9ed6d1eb9c10bbde09879cd09b3dfe8b8e8b0162fe1ea44d546caa0b355d3551
Instruction Fuzzy Hash: D921F9B5D00218BBDF15AFA0DC45EFEBBB8EF05350F104006F9A5672A2C6794919EB60

Function 00F63A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F63A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F63AA0
GetWindowLongW.USER32(?,000000F0), ref: 00F63AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F63AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F63B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00F63BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00F63BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00F63BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00F63BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00F63C13

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: c72b2397505c7338cc3405c0b2ade8195c83f6a8f90389b2cecfd0921ae6f05e
Instruction ID: 36155585d4b4421f99113823e4892386c1267ab812adda6c757d09381599b214
Opcode Fuzzy Hash: c72b2397505c7338cc3405c0b2ade8195c83f6a8f90389b2cecfd0921ae6f05e
Instruction Fuzzy Hash: FA617975A00208AFDB10DFA8CC81EEE77F8EF49714F10419AFA15A72A1D774AE45EB50

Function 00F3B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F3B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B165
GetWindowThreadProcessId.USER32(00000000), ref: 00F3B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F3B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00F3A1E1,?,00000001), ref: 00F3B21D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f658789497bb81e90e4a2f3239d9da554954db0e18c75453b02ad2be838128a0
Instruction ID: a73a8c1ee7dfaa2a5f946ed6b3039a443103c72c2889627c353ae4e9c4a4c0ce
Opcode Fuzzy Hash: f658789497bb81e90e4a2f3239d9da554954db0e18c75453b02ad2be838128a0
Instruction Fuzzy Hash: 0131DDB1900208BFDB11AF24DC69B7EBBA9BB52335F108104FB56D6190D7B4DE00AFA4

Function 00F02C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F02C94

Part of subcall function 00F029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000), ref: 00F029DE
Part of subcall function 00F029C8: GetLastError.KERNEL32(00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000,00000000), ref: 00F029F0

_free.LIBCMT ref: 00F02CA0
_free.LIBCMT ref: 00F02CAB
_free.LIBCMT ref: 00F02CB6
_free.LIBCMT ref: 00F02CC1
_free.LIBCMT ref: 00F02CCC
_free.LIBCMT ref: 00F02CD7
_free.LIBCMT ref: 00F02CE2
_free.LIBCMT ref: 00F02CED
_free.LIBCMT ref: 00F02CFB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b963a7174df728a00530f8254313c95f570bffdba351a67ef9a23d2a7edbeef
Instruction ID: a9c2183d17f87dc0f74180855e0818dddac56a124564722a973171ce63d7a928
Opcode Fuzzy Hash: 7b963a7174df728a00530f8254313c95f570bffdba351a67ef9a23d2a7edbeef
Instruction Fuzzy Hash: 9F119676500108AFCB42EF58DC46CDD3BB9FF05350F9144A5F9485B262D635EA50BBA0

Function 00F47DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F47FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00F47FC1
GetFileAttributesW.KERNEL32(?), ref: 00F47FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00F48005
SetCurrentDirectoryW.KERNEL32(?), ref: 00F48017
SetCurrentDirectoryW.KERNEL32(?), ref: 00F48060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00F480B0

Strings

*.*, xrefs: 00F48066

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: c4e5f3234ee3eb72ed5c723074c026eb87d9e6b54f99eed595261e00f8e80d10
Instruction ID: d653f0cc30186eebefe1bff6a67abca3121028b7e956f62d5424322bd12644dc
Opcode Fuzzy Hash: c4e5f3234ee3eb72ed5c723074c026eb87d9e6b54f99eed595261e00f8e80d10
Instruction Fuzzy Hash: 1481A0729083459BCB20EF14C844AAEBBE8FF84360F14495AFC85D7250EB75DD49AB92

Function 00ED5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00ED5C7A

Part of subcall function 00ED5D0A: GetClientRect.USER32(?,?), ref: 00ED5D30
Part of subcall function 00ED5D0A: GetWindowRect.USER32(?,?), ref: 00ED5D71
Part of subcall function 00ED5D0A: ScreenToClient.USER32(?,?), ref: 00ED5D99

GetDC.USER32 ref: 00F146F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F14708
SelectObject.GDI32(00000000,00000000), ref: 00F14716
SelectObject.GDI32(00000000,00000000), ref: 00F1472B
ReleaseDC.USER32(?,00000000), ref: 00F14733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F147C4

Strings

U, xrefs: 00F14693

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 7c16cb0ba8f229dd787b6a8cd854fae3d5f14969d01fe55ee8df92253a0f4882
Instruction ID: f2bddefa2391e27d76852036c8e92ab1b3fb97d38c6d7b3225c3ed751c860ddc
Opcode Fuzzy Hash: 7c16cb0ba8f229dd787b6a8cd854fae3d5f14969d01fe55ee8df92253a0f4882
Instruction Fuzzy Hash: 0571A731900209DFCF218F64C984AFA7BB5FF86365F14426AED556A2A5C731AC81EF50

Function 00F4359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00F435E4

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

LoadStringW.USER32(00FA2390,?,00000FFF,?), ref: 00F4360A

Strings

Line %d (File "%s"):, xrefs: 00F4366B
^ ERROR, xrefs: 00F436C9
Error: , xrefs: 00F436EF
"%s" (%d) : ==> %s:, xrefs: 00F43742
"%s" (%d) : ==> %s:%s%s, xrefs: 00F43724

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 5faac42c3349100514c7b4bd8a2d63d6c05b0a0e747fb5bccc0cdf8fadd49b7f
Instruction ID: 70193211ba5f8471677e8855713c476373ecb68524cdb4964056c5b58d4a79e8
Opcode Fuzzy Hash: 5faac42c3349100514c7b4bd8a2d63d6c05b0a0e747fb5bccc0cdf8fadd49b7f
Instruction Fuzzy Hash: 5F519271D00209BADF14EBA0DC42EEDBB78EF04310F145126F515722A2DB755B99EFA1

Function 00F4C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F4C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F4C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F4C2CA
GetLastError.KERNEL32 ref: 00F4C322
SetEvent.KERNEL32(?), ref: 00F4C336
InternetCloseHandle.WININET(00000000), ref: 00F4C341

Strings

, xrefs: 00F4C2BB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ce1297f74c37a5bce44d03322e4826634dbbbcd63fa746b5c2d5a4e2a1356c08
Instruction ID: 1ee118e3daea5115b564534c6dbaf7aea575b994cfc1a5e1b053f232fba7273a
Opcode Fuzzy Hash: ce1297f74c37a5bce44d03322e4826634dbbbcd63fa746b5c2d5a4e2a1356c08
Instruction Fuzzy Hash: D7317FB1601208AFD7619FA48C88ABB7FFCEB49754B14951EF886D3210DB74DD44ABE0

Function 00F3989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00F13AAF,?,?,Bad directive syntax error,00F6CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F398BC
LoadStringW.USER32(00000000,?,00F13AAF,?), ref: 00F398C3

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F39987

Strings

Line %d (File "%s"):, xrefs: 00F3992D
%s (%d) : ==> %s.: %s %s, xrefs: 00F398F1
Error: , xrefs: 00F39955
Line %d:, xrefs: 00F39912
., xrefs: 00F3996D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: fb6970b90db702ba17136d1626e7220a32244df3d784d2f447bb252bd6ffbd50
Instruction ID: 4cad1357ceefce770b78f58e0bf15b5f1af785d7ca21441658a88b97e841a01e
Opcode Fuzzy Hash: fb6970b90db702ba17136d1626e7220a32244df3d784d2f447bb252bd6ffbd50
Instruction Fuzzy Hash: 9A219E3290420EABDF15AF90CC06EEE77B5FF18700F04542AF515761A2EBB19A28EB51

Function 00F3209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00F320AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00F320C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F3214D

Strings

largeicons, xrefs: 00F320E1
smallicons, xrefs: 00F32115
SHELLDLL_DefView, xrefs: 00F320CC
details, xrefs: 00F320FB
list, xrefs: 00F3212F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 3fd4b87fb01e25fe9a9976fa3b2f7f666479c645f35d1772b30521c0f47204fd
Instruction ID: f9084cdd21516d52816ed44393c8935364dc5292fbed9965d7b27516ed40c2ad
Opcode Fuzzy Hash: 3fd4b87fb01e25fe9a9976fa3b2f7f666479c645f35d1772b30521c0f47204fd
Instruction Fuzzy Hash: 531106B7A8870AB9FA023620DC06DB7379CCB04734F201156FB04B50E2FAA2A9027658

Function 00F0CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F0CEB7
_free.LIBCMT ref: 00F0CF22
_free.LIBCMT ref: 00F0CF48
_free.LIBCMT ref: 00F0CF71
_free.LIBCMT ref: 00F0CFA9
_free.LIBCMT ref: 00F0CFDA
_free.LIBCMT ref: 00F0D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00F0D09C
_free.LIBCMT ref: 00F0D0B5

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 4d5652b9d8146ff4d1edfc92fbd24be33afb78ab6e388a1427a7996d77a728ca
Instruction ID: 789c730c585f21d165426fb02adcd4d6fc3b54b69629c04c4a48f8fc26ef18ac
Opcode Fuzzy Hash: 4d5652b9d8146ff4d1edfc92fbd24be33afb78ab6e388a1427a7996d77a728ca
Instruction Fuzzy Hash: 2E6159B2D04306AFDB21AFB49C85A6D7BA5AF01320F14426DF945A72C1DB35AD01B7F1

Function 00F650D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00F65186
ShowWindow.USER32(?,00000000), ref: 00F651C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00F651CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00F651D1

Part of subcall function 00F66FBA: DeleteObject.GDI32(00000000), ref: 00F66FE6

GetWindowLongW.USER32(?,000000F0), ref: 00F6520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F6521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F6524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00F65287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00F65296

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 30a827e35695d48d8184f5fe1932ca59a01ed03738c7cd0300c60c0f293b0f40
Instruction ID: 01347613d49fe4c125af881d52b4f1b8e40c0b51364d2957ae928c2caca54828
Opcode Fuzzy Hash: 30a827e35695d48d8184f5fe1932ca59a01ed03738c7cd0300c60c0f293b0f40
Instruction Fuzzy Hash: 4051E470E40A08BFEF209F64CC55BD93BA5FB06B24F144012F665B62E1C3B5A990FB50

Function 00EE8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00F26890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00F268A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F268B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00F268D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F268F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00EE8874,00000000,00000000,00000000,000000FF,00000000), ref: 00F26901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F2691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00EE8874,00000000,00000000,00000000,000000FF,00000000), ref: 00F2692D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d755087c04e42a7231a99707793710ad443c40c84fd727965cd9c824d18b03f7
Instruction ID: a2863b1fc9711eeb61a359c7c6840148b16fe212b4335730e2e4763b0f260642
Opcode Fuzzy Hash: d755087c04e42a7231a99707793710ad443c40c84fd727965cd9c824d18b03f7
Instruction Fuzzy Hash: 5E517CB4A00209AFDB20CF25DC55BAA77B5FF48760F104518F956E72A0DBB1E990EB50

Function 00F4C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F4C182
GetLastError.KERNEL32 ref: 00F4C195
SetEvent.KERNEL32(?), ref: 00F4C1A9

Part of subcall function 00F4C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F4C272
Part of subcall function 00F4C253: GetLastError.KERNEL32 ref: 00F4C322
Part of subcall function 00F4C253: SetEvent.KERNEL32(?), ref: 00F4C336
Part of subcall function 00F4C253: InternetCloseHandle.WININET(00000000), ref: 00F4C341

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: b4cb20eaf60ecbeccc917942f49608e5e27b138d348d76bc2e49ff71e9fa0722
Instruction ID: ebebb2b7ab036f532a0fef947c15a2fa787f1bb6d395e496093bb9d57c5f619f
Opcode Fuzzy Hash: b4cb20eaf60ecbeccc917942f49608e5e27b138d348d76bc2e49ff71e9fa0722
Instruction Fuzzy Hash: DB31BC71602605AFDB608FA4DC04A76BFE8FF58310B00552DFD9A82220D7B1E910BBE0

Function 00F325A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F33A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F33A57
Part of subcall function 00F33A3D: GetCurrentThreadId.KERNEL32 ref: 00F33A5E
Part of subcall function 00F33A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F325B3), ref: 00F33A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00F325BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F325DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00F325DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F325E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F32601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00F32605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F3260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F32623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00F32627

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 037c73374984fec4e04f19fb3aa33dc3a3a0363b0bc74792fd3bd6759a4864fa
Instruction ID: cef5c273ac0052ee6b0f75754c539b404273a0fcfab272e3287ee04709c442b5
Opcode Fuzzy Hash: 037c73374984fec4e04f19fb3aa33dc3a3a0363b0bc74792fd3bd6759a4864fa
Instruction Fuzzy Hash: B401D831390214BBFB107769DC8AF693F59DF4EB21F100001F3A8AE0D2C9F22444AAA9

Function 00F31803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00F31449,?,?,00000000), ref: 00F3180C
HeapAlloc.KERNEL32(00000000,?,00F31449,?,?,00000000), ref: 00F31813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F31449,?,?,00000000), ref: 00F31828
GetCurrentProcess.KERNEL32(?,00000000,?,00F31449,?,?,00000000), ref: 00F31830
DuplicateHandle.KERNEL32(00000000,?,00F31449,?,?,00000000), ref: 00F31833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F31449,?,?,00000000), ref: 00F31843
GetCurrentProcess.KERNEL32(00F31449,00000000,?,00F31449,?,?,00000000), ref: 00F3184B
DuplicateHandle.KERNEL32(00000000,?,00F31449,?,?,00000000), ref: 00F3184E
CreateThread.KERNEL32(00000000,00000000,00F31874,00000000,00000000,00000000), ref: 00F31868

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d467ad13d4c28004b883ea5acc35e1b5ee26efb3b0dc3203447a29b48389c5f0
Instruction ID: a4db7853dba07473c3229e3c3f78c4782d246211a6fa0819ac142338ce9e052d
Opcode Fuzzy Hash: d467ad13d4c28004b883ea5acc35e1b5ee26efb3b0dc3203447a29b48389c5f0
Instruction Fuzzy Hash: D901BF75240348BFE710AB65DC4DF6B3B6CEB8AB11F004411FA95DB192C6B19800EB70

Function 00F03E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F03F0B
__alldvrm.LIBCMT ref: 00F0410C
__alldvrm.LIBCMT ref: 00F0412E

Strings

}}, xrefs: 00F03E96, 00F03EF1, 00F03F0A, 00F04090
}}, xrefs: 00F040CD
}}, xrefs: 00F03E8A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}$}}$}}
API String ID: 1036877536-1495402609
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: a73a06a7f52ce982819102faf9bd60b83de2f2853abc14e1e7b925082fa031d9
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: AFA149B2E043869FDB16CF18CC917AEBBE5EF61360F14416DE6959B2C1C238A981F750

Function 00F5A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00F3D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00F3D501
Part of subcall function 00F3D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00F3D50F
Part of subcall function 00F3D4DC: CloseHandle.KERNELBASE(00000000), ref: 00F3D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F5A16D
GetLastError.KERNEL32 ref: 00F5A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F5A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F5A268
GetLastError.KERNEL32(00000000), ref: 00F5A273
CloseHandle.KERNEL32(00000000), ref: 00F5A2C4

Strings

SeDebugPrivilege, xrefs: 00F5A18F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f91fc2432f87e65f2b2b7795d9600e74204b9543aff0cd1aade9a3573044ec6e
Instruction ID: ac5220f566202db8ddb8f510870cddf676ea554ac356395dee0a899990388225
Opcode Fuzzy Hash: f91fc2432f87e65f2b2b7795d9600e74204b9543aff0cd1aade9a3573044ec6e
Instruction Fuzzy Hash: 4561C3316046429FD710DF18C495F25BBE1EF44328F18858CE9A68B7A3C776EC4ADB92

Function 00F63886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F63925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00F6393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F63954
_wcslen.LIBCMT ref: 00F63999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00F639C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F639F4

Strings

SysListView32, xrefs: 00F638F7

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: aa7e9c9bfa7c30c5e2c991c209f558a37aa64925f49d44525a26b6af5d6b4c5d
Instruction ID: 08d84e7964e5ef6d42dbb1733a54680e179404dfcfb8d846ff7c363560e59749
Opcode Fuzzy Hash: aa7e9c9bfa7c30c5e2c991c209f558a37aa64925f49d44525a26b6af5d6b4c5d
Instruction Fuzzy Hash: 4A418271E00319ABEF219F64CC45FEA77A9EF08364F100526F958E7281D7B59980EB90

Function 00F3BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F3BCFD
IsMenu.USER32(00000000), ref: 00F3BD1D
CreatePopupMenu.USER32 ref: 00F3BD53
GetMenuItemCount.USER32(009A6A00), ref: 00F3BDA4
InsertMenuItemW.USER32(009A6A00,?,00000001,00000030), ref: 00F3BDCC

Strings

2, xrefs: 00F3BD37
0, xrefs: 00F3BCA8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 21a6c625072e771e982a2af6944aee7ba148ab03ad7b41e8de4e8512eafca6d7
Instruction ID: 99e2abb871c77921446f4538435622174179bf9ccdf35a9417d5a8b46b0e4a41
Opcode Fuzzy Hash: 21a6c625072e771e982a2af6944aee7ba148ab03ad7b41e8de4e8512eafca6d7
Instruction Fuzzy Hash: 7A51BF70A002099BDF20DFA8DCA8BAEBBF4BF45334F144219E651E7291D7709941EB61

Function 00EF2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00EF2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00EF2D53
_ValidateLocalCookies.LIBCMT ref: 00EF2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00EF2E0C
_ValidateLocalCookies.LIBCMT ref: 00EF2E61

Strings

csm, xrefs: 00EF2DF6
&H, xrefs: 00EF2DFE, 00EF2E07, 00EF2E18

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H$csm
API String ID: 1170836740-1242228090
Opcode ID: 3067d1d9329089a2f252cfd824a94c0a2d729d901cad5685071f553f0150ba0d
Instruction ID: 8fb9091a01122898b411935e6baf77774a362a754c7a69f0aae1f6facda06bcf
Opcode Fuzzy Hash: 3067d1d9329089a2f252cfd824a94c0a2d729d901cad5685071f553f0150ba0d
Instruction Fuzzy Hash: 9641A234A0020DABCF14DF68C845AAEBBB5BF45328F149159EB14BB392D7369A01CBD1

Function 00F3C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F3C913

Strings

stop, xrefs: 00F3C8E4
info, xrefs: 00F3C8B4
question, xrefs: 00F3C8CC
blank, xrefs: 00F3C895
warning, xrefs: 00F3C8FC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: d9a6744e6f289cb10272ddcc90e2c93c525454ba6c346ad4196e2505bb1e8beb
Instruction ID: 3995f7f72e4493518f754db1ed509c3e81561eca55e98dcea242d24904d1180d
Opcode Fuzzy Hash: d9a6744e6f289cb10272ddcc90e2c93c525454ba6c346ad4196e2505bb1e8beb
Instruction Fuzzy Hash: B211DB32A8A70ABAA70597549C82EAB7BDCDF15774F11006AF500B51C1EBA0AE0073E5

Function 00F3DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F3DE42
gethostname.WSOCK32(?,00000100), ref: 00F3DE5C
gethostbyname.WSOCK32(?), ref: 00F3DE69
inet_ntoa.WSOCK32(?), ref: 00F3DEAB
_strcat.LIBCMT ref: 00F3DEB9
WSACleanup.WSOCK32 ref: 00F3DEDE

Strings

0.0.0.0, xrefs: 00F3DE87

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 8fc47cb004c0841568b37e6300b0a67f5119660bdd6969aef98a871c16b75149
Instruction ID: 9c6c8e799f5fc7ba66a73a3a6ca68decb1168fe38d0cd3ea621891b3db0a893e
Opcode Fuzzy Hash: 8fc47cb004c0841568b37e6300b0a67f5119660bdd6969aef98a871c16b75149
Instruction Fuzzy Hash: AA11E771904119ABCB206B20AC0AEFF7BBCDF50730F050169F595A7091EFB59A81AAA0

Function 00F69F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

GetSystemMetrics.USER32(0000000F), ref: 00F69FC7
GetSystemMetrics.USER32(0000000F), ref: 00F69FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00F6A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F6A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F6A263
ShowWindow.USER32(00000003,00000000), ref: 00F6A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00F6A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00F6A2CA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: f71ac3ff6b1c4bd1efc8c70dfc03b692fbe60b24d132e39d22737f9c0d3f2f58
Instruction ID: fbd4b8e506c58c9202c1fa1da782e1d71376f26c197ff7a21b1a80787366647f
Opcode Fuzzy Hash: f71ac3ff6b1c4bd1efc8c70dfc03b692fbe60b24d132e39d22737f9c0d3f2f58
Instruction Fuzzy Hash: 67B1DC31A00219DFDF14CF68C9947AE3BB2FF45711F098069EC89AB295D771A940EF51

Function 00F3ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F3ED2A
_wcslen.LIBCMT ref: 00F3ED3B
_wcslen.LIBCMT ref: 00F3ED79
_wcslen.LIBCMT ref: 00F3EDAF
_wcslen.LIBCMT ref: 00F3EDDF
_wcslen.LIBCMT ref: 00F3EDEF
_wcslen.LIBCMT ref: 00F3EE2B
_wcslen.LIBCMT ref: 00F3EE5A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 3ef39e936a444fa6c5927442814559e7ad97804ccbef7cda5713c8cb3eb7b082
Instruction ID: 086149c3800c635f1077d55c183cfd7827e553f9208ed340457e4308ac038a62
Opcode Fuzzy Hash: 3ef39e936a444fa6c5927442814559e7ad97804ccbef7cda5713c8cb3eb7b082
Instruction Fuzzy Hash: 5A41BF65D1021CA6DB11EBB48C8A9DFB7ECAF45710F409466E618F3161EB34E245C3E5

Function 00EEF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00F2682C,00000004,00000000,00000000), ref: 00EEF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00F2682C,00000004,00000000,00000000), ref: 00F2F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00F2682C,00000004,00000000,00000000), ref: 00F2F454

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 2fb31a280774299fe25f3206f2f4a46d2421140fb86f0d38a6666b769bfcaba6
Instruction ID: edced41ceae0b0892012b447ed8511c09eb0f5b67adc13207d7d988b1b346e3e
Opcode Fuzzy Hash: 2fb31a280774299fe25f3206f2f4a46d2421140fb86f0d38a6666b769bfcaba6
Instruction Fuzzy Hash: D9416C315042C8BAC734DB6AE88877A7BA1AFC6314F15603DE0C777562C677D880EB11

Function 00F62D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F62D1B
GetDC.USER32(00000000), ref: 00F62D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F62D2E
ReleaseDC.USER32(00000000,00000000), ref: 00F62D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00F62D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F62D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F65A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00F62DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F62DE1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: beab8fef33398390b95a9c0d0464a4f7a6d39c55b75974318dc044b272082834
Instruction ID: c86ade9eb362ba464f3947d0980e61655e2569a3f46fb9ae2eb1162e5ba5c5d8
Opcode Fuzzy Hash: beab8fef33398390b95a9c0d0464a4f7a6d39c55b75974318dc044b272082834
Instruction Fuzzy Hash: 73316B72201614BBEB118F54CC8AFFB3BA9EF09725F044055FE889A291C6B59C51DBA4

Function 00F35622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00F35637
_memcmp.LIBVCRUNTIME ref: 00F35659
_memcmp.LIBVCRUNTIME ref: 00F35671
_memcmp.LIBVCRUNTIME ref: 00F35684
_memcmp.LIBVCRUNTIME ref: 00F3569E
_memcmp.LIBVCRUNTIME ref: 00F356B1
_memcmp.LIBVCRUNTIME ref: 00F356C9
_memcmp.LIBVCRUNTIME ref: 00F356E4

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 5cb7465f232adbfe6760ec6fc8f4d2e127a8732396e495fe1800ce9792658107
Instruction ID: f947f90b9d14e90102716d29a1003f3c5de6fcdd751f909f1dec4e541baed20b
Opcode Fuzzy Hash: 5cb7465f232adbfe6760ec6fc8f4d2e127a8732396e495fe1800ce9792658107
Instruction Fuzzy Hash: E821C9B2B45A0DB7D61455209D83FFA339DAFA0BB4F850020FE05AA581F720EE14E5E6

Function 00F54FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00F55007
NULL Pointer assignment, xrefs: 00F5502E, 00F55383

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: e2a31432d0351f82d4bda5334a0459042442b495a21af9faad0b9aac9ae88135
Instruction ID: 40167db24aba9bd369f19fada26c4e7b6c528a7118293bebe9d974e5e60f0f73
Opcode Fuzzy Hash: e2a31432d0351f82d4bda5334a0459042442b495a21af9faad0b9aac9ae88135
Instruction Fuzzy Hash: E3D1E171E0060A9FDF10CFA8C890BAEB7B5BF48754F148069EE15AB281E770DD49DB90

Function 00F11522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00F115CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F11651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F116E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F116FB

Part of subcall function 00F03820: RtlAllocateHeap.NTDLL(00000000,?,00FA1444,?,00EEFDF5,?,?,00EDA976,00000010,00FA1440,00ED13FC,?,00ED13C6,?,00ED1129), ref: 00F03852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F11777
__freea.LIBCMT ref: 00F117A2
__freea.LIBCMT ref: 00F117AE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 3f997a9267800fb0bcb798ea4aba52bf1388ff6c92127289bec70bf1fc1b396e
Instruction ID: 3177b6289a96735ff6e5743dd924eb081798f97d81e7fad9f4a92dd186426fcc
Opcode Fuzzy Hash: 3f997a9267800fb0bcb798ea4aba52bf1388ff6c92127289bec70bf1fc1b396e
Instruction Fuzzy Hash: 9D91B672E002169EDF208E74DC41AEE7BB6BF49720F184659EA05E7281D735DDC4EBA0

Function 00F54523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F54648
VariantInit.OLEAUT32(?), ref: 00F54749
VariantClear.OLEAUT32(?), ref: 00F54753
VariantClear.OLEAUT32(?), ref: 00F547B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00F5472C
Null Object assignment in FOR..IN loop, xrefs: 00F545D8, 00F54706, 00F547BE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 349f347ed0d2d61cb232ff9f37808643c027274dd7da91b57f3417ffa548689a
Instruction ID: 80cf2f6875409a2264081aa92d19d5f4a3f92b9a14faa4448ce2df135253ed97
Opcode Fuzzy Hash: 349f347ed0d2d61cb232ff9f37808643c027274dd7da91b57f3417ffa548689a
Instruction Fuzzy Hash: 7791C631E00219ABDF20CF55DC44FAEBBB8EF45715F108119FA05AB180D770A989DFA0

Function 00F41187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00F4125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00F41284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00F412A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F412D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F4135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F413C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00F41430

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: ea22393d70089fd8011a68655efeb018773a11f9fe5f91ecb919208b8e677d65
Instruction ID: 823740629c21ea2b1c0afa58886d6b6e23196dfd99b045ed8d092ab26d4c227e
Opcode Fuzzy Hash: ea22393d70089fd8011a68655efeb018773a11f9fe5f91ecb919208b8e677d65
Instruction Fuzzy Hash: B391F476E002189FDB00DF94C884BBE7BB5FF45324F144129ED50E72A1D7B8A981EB90

Function 00EE948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 2b413d2180c286ad1dade5da4e36723ee652f59377518b6d909e156b87e5a237
Instruction ID: 42d07238f68e130b0f7c84d587a55dfefa7a2cf515571472c2f88560e53b883a
Opcode Fuzzy Hash: 2b413d2180c286ad1dade5da4e36723ee652f59377518b6d909e156b87e5a237
Instruction Fuzzy Hash: FF912671D00219EFCB10CFAACC84AEEBBB8FF49320F149559E515B7292D774A941DBA0

Function 00F53947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F5396B
CharUpperBuffW.USER32(?,?), ref: 00F53A7A
_wcslen.LIBCMT ref: 00F53A8A
VariantClear.OLEAUT32(?), ref: 00F53C1F

Part of subcall function 00F40CDF: VariantInit.OLEAUT32(00000000), ref: 00F40D1F
Part of subcall function 00F40CDF: VariantCopy.OLEAUT32(?,?), ref: 00F40D28
Part of subcall function 00F40CDF: VariantClear.OLEAUT32(?), ref: 00F40D34

Strings

Incorrect Parameter format, xrefs: 00F539A6, 00F53BA1
AUTOIT.ERROR, xrefs: 00F53A80, 00F53A85

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 52654616135c1eda8c4a93731026223b5d94da86fa671f5ef2a652ca9e9e4201
Instruction ID: 2ce3e4f2856ab8f690f10c849aa56ed1a96dcaddb1cd6a4e53b863793946b5b5
Opcode Fuzzy Hash: 52654616135c1eda8c4a93731026223b5d94da86fa671f5ef2a652ca9e9e4201
Instruction Fuzzy Hash: BD91BE75A083059FC704DF28C48092AB7E5FF88355F04892EF9899B351DB35EE4ADB82

Function 00F54BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00F3000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?,?,00F3035E), ref: 00F3002B
Part of subcall function 00F3000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?), ref: 00F30046
Part of subcall function 00F3000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?), ref: 00F30054
Part of subcall function 00F3000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?), ref: 00F30064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00F54C51
_wcslen.LIBCMT ref: 00F54D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00F54DCF
CoTaskMemFree.OLE32(?), ref: 00F54DDA

Strings

NULL Pointer assignment, xrefs: 00F54E23, 00F54E52

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: e0251c608c5f2ab7df27b6f99daffeea8146f68ac626fa155a92ce1453cf3615
Instruction ID: a8870baab69411dcf37586a3cf9a831c6051735a157a54a23ad54e896fa17d67
Opcode Fuzzy Hash: e0251c608c5f2ab7df27b6f99daffeea8146f68ac626fa155a92ce1453cf3615
Instruction Fuzzy Hash: 9B913671D0021D9BDF14DFA4D891AEEB7B8FF48314F10416AE915B7281DB34AA499FA0

Function 00F620FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00F62183
GetMenuItemCount.USER32(00000000), ref: 00F621B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F621DD
_wcslen.LIBCMT ref: 00F62213
GetMenuItemID.USER32(?,?), ref: 00F6224D
GetSubMenu.USER32(?,?), ref: 00F6225B

Part of subcall function 00F33A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F33A57
Part of subcall function 00F33A3D: GetCurrentThreadId.KERNEL32 ref: 00F33A5E
Part of subcall function 00F33A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F325B3), ref: 00F33A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F622E3

Part of subcall function 00F3E97B: Sleep.KERNEL32 ref: 00F3E9F3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 6288c0c1b18e905001541f92bb6f3813695fc9f5fc6f3dbc127199e8fa21bc74
Instruction ID: c6d86f7a83abb75a4b2dd218f61c04d54cb48d00aaffad92daf2f5665a9a06b2
Opcode Fuzzy Hash: 6288c0c1b18e905001541f92bb6f3813695fc9f5fc6f3dbc127199e8fa21bc74
Instruction Fuzzy Hash: 5B719E76E00605AFCB50DF64C881AAEB7F1EF89320F148459E856FB351DB74EE419B90

Function 00F67E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(009A69D8), ref: 00F67F37
IsWindowEnabled.USER32(009A69D8), ref: 00F67F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00F6801E
SendMessageW.USER32(009A69D8,000000B0,?,?), ref: 00F68051
IsDlgButtonChecked.USER32(?,?), ref: 00F68089
GetWindowLongW.USER32(009A69D8,000000EC), ref: 00F680AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00F680C3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 944772c7ff47551ddecbf8477b74b9381b8fc5c6ac38a853823ea2c6648bff7d
Instruction ID: 654fdad630e66367bf704670db770a6b1e9a45d99201ecbf60a4757d07e8ba75
Opcode Fuzzy Hash: 944772c7ff47551ddecbf8477b74b9381b8fc5c6ac38a853823ea2c6648bff7d
Instruction Fuzzy Hash: 9871CF34A08344AFEB20AF64CC84FBA7BB5FF0A364F140459F99593261CB71AC45EB90

Function 00F3AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F3AEF9
GetKeyboardState.USER32(?), ref: 00F3AF0E
SetKeyboardState.USER32(?), ref: 00F3AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F3AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F3AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F3AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F3B020

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ec28a4f330a7c2e79d29c4748640083345510e042973a202d407b1bdf6f8b73c
Instruction ID: cf8908a3756a3ae36f992ce0c1e8cd1a274aa62675de5388fbc7f130d55f97fe
Opcode Fuzzy Hash: ec28a4f330a7c2e79d29c4748640083345510e042973a202d407b1bdf6f8b73c
Instruction Fuzzy Hash: 6051D1A0A047D53DFB364235CC55BBBBEA95B06324F088589E2E9598C2C3D9ECC8E751

Function 00F3ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F3AD19
GetKeyboardState.USER32(?), ref: 00F3AD2E
SetKeyboardState.USER32(?), ref: 00F3AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F3ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F3ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F3AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F3AE38

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: aa7c8d9886e728dd63038d90f9545d8c10843d34644216b3b0c78ce0c73ab79e
Instruction ID: 6a05d8a753f34078de1c68a21b7f3c240e48d43873b6929e25d43325b5c74ca7
Opcode Fuzzy Hash: aa7c8d9886e728dd63038d90f9545d8c10843d34644216b3b0c78ce0c73ab79e
Instruction Fuzzy Hash: 5851D5A1A047D53DFB378336CC55B7A7EA85B46320F088588E1D94A8C2D394ECD8F762

Function 00F0542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00F13CD6,?,?,?,?,?,?,?,?,00F05BA3,?,?,00F13CD6,?,?), ref: 00F05470
__fassign.LIBCMT ref: 00F054EB
__fassign.LIBCMT ref: 00F05506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00F13CD6,00000005,00000000,00000000), ref: 00F0552C
WriteFile.KERNEL32(?,00F13CD6,00000000,00F05BA3,00000000,?,?,?,?,?,?,?,?,?,00F05BA3,?), ref: 00F0554B
WriteFile.KERNEL32(?,?,00000001,00F05BA3,00000000,?,?,?,?,?,?,?,?,?,00F05BA3,?), ref: 00F05584

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ef7959e9c85ebb7e0dfa019300e5326decb2327b90d51fffdf8c075dfbe491d9
Instruction ID: 04175f3389c240c4d3eb6b7efce666e23f7ec0907fabbf15c28e6b50c68a733a
Opcode Fuzzy Hash: ef7959e9c85ebb7e0dfa019300e5326decb2327b90d51fffdf8c075dfbe491d9
Instruction Fuzzy Hash: DD51C0B1A006099FDB10CFA8DC45AEEBBF9EF09710F18411AE955E7291D7709A41EF60

Function 00F510B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00F5307A
Part of subcall function 00F5304E: _wcslen.LIBCMT ref: 00F5309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F51112
WSAGetLastError.WSOCK32 ref: 00F51121
WSAGetLastError.WSOCK32 ref: 00F511C9
closesocket.WSOCK32(00000000), ref: 00F511F9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: e747bda0b65bbccd5f1843480a1ef8267e12973cca9502961128cf90be79001d
Instruction ID: b7de8aaa380d35272b9f3895deaeade55682c3a0c5e52ba448677871037848e2
Opcode Fuzzy Hash: e747bda0b65bbccd5f1843480a1ef8267e12973cca9502961128cf90be79001d
Instruction Fuzzy Hash: C7412731600A08AFDB109F24C884BA9BBE9FF45365F148099FE559B291C774FD45DBE0

Function 00F3CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F3CF22,?), ref: 00F3DDFD

Part of subcall function 00F3DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F3CF22,?), ref: 00F3DE16

lstrcmpiW.KERNEL32(?,?), ref: 00F3CF45
MoveFileW.KERNEL32(?,?), ref: 00F3CF7F
_wcslen.LIBCMT ref: 00F3D005
_wcslen.LIBCMT ref: 00F3D01B
SHFileOperationW.SHELL32(?), ref: 00F3D061

Strings

\*.*, xrefs: 00F3CFF3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: f3d5c665f4403a684b025411d26f128502cd2a638692bdc335317caef08000cb
Instruction ID: 27511c0770a151218cd15fd83323431c700791ab8c3eaa3112ab92722baf1496
Opcode Fuzzy Hash: f3d5c665f4403a684b025411d26f128502cd2a638692bdc335317caef08000cb
Instruction Fuzzy Hash: 7D414475D0521C9EDF12EBA4DD81AEEB7B8AF08390F1000E6E545FB142EA34A649DF50

Function 00F62DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00F62E1C
GetWindowLongW.USER32(?,000000F0), ref: 00F62E4F
GetWindowLongW.USER32(?,000000F0), ref: 00F62E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00F62EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00F62EE0
GetWindowLongW.USER32(?,000000F0), ref: 00F62EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F62F0B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 450811b07a2ad3708ee9ea6c8ec86a9ed346db20ad73692ff8edeb99c0534bc1
Instruction ID: e8ff89989f4d842d92ba31293cf8bd09fd40c79885add8110c3c8835bae23da2
Opcode Fuzzy Hash: 450811b07a2ad3708ee9ea6c8ec86a9ed346db20ad73692ff8edeb99c0534bc1
Instruction Fuzzy Hash: B6311531A445489FEB60CF58DC84F6537E0FB6A720F150165F9948B2B2CBB2A840FB41

Function 00F37726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F37769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F3778F
SysAllocString.OLEAUT32(00000000), ref: 00F37792
SysAllocString.OLEAUT32(?), ref: 00F377B0
SysFreeString.OLEAUT32(?), ref: 00F377B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00F377DE
SysAllocString.OLEAUT32(?), ref: 00F377EC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 58679f29b157ef0e20ef2825a91253ca55ede731e21c98ea5114c65cd202b46e
Instruction ID: 7112c88325ec57a9581cf63c0e2e8ce99a4986f26122f1cb75f9692d1b7bb9ec
Opcode Fuzzy Hash: 58679f29b157ef0e20ef2825a91253ca55ede731e21c98ea5114c65cd202b46e
Instruction Fuzzy Hash: A4218376608219AFDB20EFA9CC84DBB77ACEB09774B048025F955DB150D670DC41E7A0

Function 00F377FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F37842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F37868
SysAllocString.OLEAUT32(00000000), ref: 00F3786B
SysAllocString.OLEAUT32 ref: 00F3788C
SysFreeString.OLEAUT32 ref: 00F37895
StringFromGUID2.OLE32(?,?,00000028), ref: 00F378AF
SysAllocString.OLEAUT32(?), ref: 00F378BD

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 37cae778a2f7f60858b0bbc9abfd3e393b4e865e6c808dfc78e41d735d1fe9cb
Instruction ID: c7cabeda1fb1161eb5d01e767dd3d364ad23f33858c7f5e8ab61b89f71ced98a
Opcode Fuzzy Hash: 37cae778a2f7f60858b0bbc9abfd3e393b4e865e6c808dfc78e41d735d1fe9cb
Instruction Fuzzy Hash: 5221A771604209AFDB20EFB9DC88DBA77ECEB09370B108125F955DB1A1DA70DC41EB64

Function 00F404D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00F404F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F4052E

Strings

nul, xrefs: 00F40567

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 48ca51910e7a2e820baa087bc76660ec034145b5abf7d1068419ac2316626ad9
Instruction ID: e084b37d91ae2dcafc6f07258085f293ea0578b9cf29cbe1710d1a9f44ccf4d2
Opcode Fuzzy Hash: 48ca51910e7a2e820baa087bc76660ec034145b5abf7d1068419ac2316626ad9
Instruction Fuzzy Hash: 7B215E75900305ABDB209F29DC44AAA7BA4EF45724F244A19EEE1D72E0DBB09940EF60

Function 00F405A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F405C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F40601

Strings

nul, xrefs: 00F40639

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: b77cee02ba65c305d4526cce1ecf41bce7306c26c70ad8b95eb5373bdb084b59
Instruction ID: 31a2a66547898df9437d24b0897c100ca35ed2e4cf084c1687905c6267b61c4c
Opcode Fuzzy Hash: b77cee02ba65c305d4526cce1ecf41bce7306c26c70ad8b95eb5373bdb084b59
Instruction Fuzzy Hash: D92183759003059BDB209F698C14A6A7BE4AF95730F204A19FEE2E72D0DBB09860EB50

Function 00F640AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00ED604C
Part of subcall function 00ED600E: GetStockObject.GDI32(00000011), ref: 00ED6060
Part of subcall function 00ED600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F64112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F6411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F6412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F64139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F64145

Strings

Msctls_Progress32, xrefs: 00F640E3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9520a7e04512df056b124f66f4e9a8f2e87c9346f5a6852e60a43234b2ebc976
Instruction ID: 35c83d11b1acb4e7a3c33fa8513263a572153d234890d8925f910fef6584d21d
Opcode Fuzzy Hash: 9520a7e04512df056b124f66f4e9a8f2e87c9346f5a6852e60a43234b2ebc976
Instruction Fuzzy Hash: 7E1193B215021D7EEF119E64CC85EE77F5DEF09798F014111BA18A2150C6769C61ABA4

Function 00F0D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F0D7A3: _free.LIBCMT ref: 00F0D7CC

_free.LIBCMT ref: 00F0D82D

Part of subcall function 00F029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000), ref: 00F029DE
Part of subcall function 00F029C8: GetLastError.KERNEL32(00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000,00000000), ref: 00F029F0

_free.LIBCMT ref: 00F0D838
_free.LIBCMT ref: 00F0D843
_free.LIBCMT ref: 00F0D897
_free.LIBCMT ref: 00F0D8A2
_free.LIBCMT ref: 00F0D8AD
_free.LIBCMT ref: 00F0D8B8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: e2a60286c13dcd70f956bb8557ac41d35ab3dbd924911d6c808809d5dcaecf59
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: A1112E71940B04AAD665BFF4CC4BFCBBBECAF44700F804825B299A64D2DA79B505B660

Function 00F3DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F3DA74
LoadStringW.USER32(00000000), ref: 00F3DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F3DA91
LoadStringW.USER32(00000000), ref: 00F3DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F3DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F3DAB9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 91df52bb5d06dfbf903f2a28672a63c6a1b6f549750da7dfddb92dc2e57dc9d6
Instruction ID: 58c7d82f391fac4a34b724d17430c6caa448279240f83b2041ab856baf92cf6b
Opcode Fuzzy Hash: 91df52bb5d06dfbf903f2a28672a63c6a1b6f549750da7dfddb92dc2e57dc9d6
Instruction Fuzzy Hash: CF0162F290020C7FEB10ABA4DD89EF7726CE708711F400492F796E2042E6B49E845FB4

Function 00F4096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0099E448,0099E448), ref: 00F4097B
EnterCriticalSection.KERNEL32(0099E428,00000000), ref: 00F4098D
TerminateThread.KERNEL32(?,000001F6), ref: 00F4099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00F409A9
CloseHandle.KERNEL32(?), ref: 00F409B8
InterlockedExchange.KERNEL32(0099E448,000001F6), ref: 00F409C8
LeaveCriticalSection.KERNEL32(0099E428), ref: 00F409CF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: f3657526b0db5dadf3c940050a0c61c278f222afb68f8743dec1fdcad43422b0
Instruction ID: b9d4bc3a99e2238a4621efc6440102f70e72e629453b791e8a0854666f60c96e
Opcode Fuzzy Hash: f3657526b0db5dadf3c940050a0c61c278f222afb68f8743dec1fdcad43422b0
Instruction Fuzzy Hash: E7F03131442506BBD7415FA5EE9DBE67B35FF01712F401015F691508A0CBB59465EFE0

Function 00ED5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00ED5D30
GetWindowRect.USER32(?,?), ref: 00ED5D71
ScreenToClient.USER32(?,?), ref: 00ED5D99
GetClientRect.USER32(?,?), ref: 00ED5ED7
GetWindowRect.USER32(?,?), ref: 00ED5EF8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 1e961c9e193d32cb5737bc793ed6c4b3d8e7ae1de2f5cf6b32b7c2db1a19ffa6
Instruction ID: 00b6c4bbf69a5b0540ef9ad4e8583818f39db58dc9041b49b272e626a8101ea8
Opcode Fuzzy Hash: 1e961c9e193d32cb5737bc793ed6c4b3d8e7ae1de2f5cf6b32b7c2db1a19ffa6
Instruction Fuzzy Hash: 5FB18C35A0074ADBDB10DFA9C4807EEB7F1FF58320F14951AE8A9E7250DB30AA91DB54

Function 00F001B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00F000BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F000D6
__allrem.LIBCMT ref: 00F000ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F0010B
__allrem.LIBCMT ref: 00F00122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F00140

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: c9ebbac99738b6a0f89055187a369d5b971c20873014b5e11372f7b9ae99fabf
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 7281D872A00B069BE7249E68CC41B6BB3E9AF45734F24463AF651D62C1EB74D940B790

Function 00F51D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F53149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00F5101C,00000000,?,?,00000000), ref: 00F53195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00F51DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00F51DE1
WSAGetLastError.WSOCK32 ref: 00F51DF2
inet_ntoa.WSOCK32(?), ref: 00F51E8C
htons.WSOCK32(?,?,?,?,?), ref: 00F51EDB
_strlen.LIBCMT ref: 00F51F35

Part of subcall function 00F339E8: _strlen.LIBCMT ref: 00F339F2

Part of subcall function 00ED6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00EECF58,?,?,?), ref: 00ED6DBA
Part of subcall function 00ED6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00EECF58,?,?,?), ref: 00ED6DED

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 4fe6874027e47ba0edb0a7c8e470088aaa1944c479cd538f02ca35c94d31b663
Instruction ID: 88a075e8d91f221bd623fd418bf478e37c91a5886c282ce4b66d70ffe4f8ba7a
Opcode Fuzzy Hash: 4fe6874027e47ba0edb0a7c8e470088aaa1944c479cd538f02ca35c94d31b663
Instruction Fuzzy Hash: 0DA1CE31604340AFC324DB24C885F2A7BE5BF84328F54994DF9566B2A2CB71ED4ADB91

Function 00F061FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00EF82D9,00EF82D9,?,?,?,00F0644F,00000001,00000001,?), ref: 00F06258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F0644F,00000001,00000001,?,?,?,?), ref: 00F062DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F063D8
__freea.LIBCMT ref: 00F063E5

Part of subcall function 00F03820: RtlAllocateHeap.NTDLL(00000000,?,00FA1444,?,00EEFDF5,?,?,00EDA976,00000010,00FA1440,00ED13FC,?,00ED13C6,?,00ED1129), ref: 00F03852

__freea.LIBCMT ref: 00F063EE
__freea.LIBCMT ref: 00F06413

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: ab7c8a0c069f30054eb64f623d59ab76d919b897769b24d88b542fafc45f9ebd
Instruction ID: 4873cb8a7ce7a7298f531373502843b0a1f2ff65bf91c488e5fc5d6a5ad1f46f
Opcode Fuzzy Hash: ab7c8a0c069f30054eb64f623d59ab76d919b897769b24d88b542fafc45f9ebd
Instruction Fuzzy Hash: 52519072A00216ABDB258F64DD81EBF77AAEF44760F154629F905D62C0DB34DC60F6A0

Function 00F5BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F5C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F5B6AE,?,?), ref: 00F5C9B5
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5C9F1
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA68
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F5BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F5BD25
RegCloseKey.ADVAPI32(00000000), ref: 00F5BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F5BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F5BDF3
RegCloseKey.ADVAPI32(?), ref: 00F5BDFF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 5f8ab8a20565680a25dfc2e33ad6347f7f99dcdfe6a8d135d9a5f8dce9292bad
Instruction ID: 25cf19a20f1f5df71442be76e58b6cc242a11fe80959577770b1cb6bbba2c0d9
Opcode Fuzzy Hash: 5f8ab8a20565680a25dfc2e33ad6347f7f99dcdfe6a8d135d9a5f8dce9292bad
Instruction Fuzzy Hash: 12819E31608241AFC714DF24C895E2ABBF5FF84318F14856DF9958B2A2DB31ED09DB92

Function 00F2F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00F2F7B9
SysAllocString.OLEAUT32(00000001), ref: 00F2F860
VariantCopy.OLEAUT32(00F2FA64,00000000), ref: 00F2F889
VariantClear.OLEAUT32(00F2FA64), ref: 00F2F8AD
VariantCopy.OLEAUT32(00F2FA64,00000000), ref: 00F2F8B1
VariantClear.OLEAUT32(?), ref: 00F2F8BB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: d03ba7d5f14aa5cbed12cec9b999a381379f50f0f40b83fa093b328df74abdc8
Instruction ID: 528e734bf77bbcf94db8eb7bf0053ef1c1c9942629250542b672ba5e9a8b5e25
Opcode Fuzzy Hash: d03ba7d5f14aa5cbed12cec9b999a381379f50f0f40b83fa093b328df74abdc8
Instruction Fuzzy Hash: AF51D731920324BADF10AB65EC95B29B3F4EF45310B205477E805EF291DB748C84E796

Function 00F4910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00ED7620: _wcslen.LIBCMT ref: 00ED7625

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00F494E5
_wcslen.LIBCMT ref: 00F49506
_wcslen.LIBCMT ref: 00F4952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00F49585

Strings

X, xrefs: 00F49412

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 16f5b605b82378a3d9a52cc8fd11e86dc36a61a423550c8055ee7324911b392d
Instruction ID: f61094a34bdf45d196b5d05636a5d2be18ddfcad6f4db4f4c99ac1c455ab3806
Opcode Fuzzy Hash: 16f5b605b82378a3d9a52cc8fd11e86dc36a61a423550c8055ee7324911b392d
Instruction Fuzzy Hash: 20E19131A083418FD714DF24C881A6BBBE5FF85314F14856EE889AB3A2DB71DD05DB92

Function 00EE920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

BeginPaint.USER32(?,?,?), ref: 00EE9241
GetWindowRect.USER32(?,?), ref: 00EE92A5
ScreenToClient.USER32(?,?), ref: 00EE92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00EE92D3
EndPaint.USER32(?,?,?,?,?), ref: 00EE9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00F271EA

Part of subcall function 00EE9339: BeginPath.GDI32(00000000), ref: 00EE9357

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 9a77512d9c50e5da77943166f26123ad855ba4423776a6db69c24fa76278f378
Instruction ID: a0dc174edd09f8269b3feaae1ade423fb64ce7ad684e128e1162a9e18fa8f6ab
Opcode Fuzzy Hash: 9a77512d9c50e5da77943166f26123ad855ba4423776a6db69c24fa76278f378
Instruction Fuzzy Hash: 4A419D70104358AFD721DF25D884FBA7BE8EF4A760F140229F9A4971E2C7719845EB62

Function 00F407EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00F4080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00F40847
EnterCriticalSection.KERNEL32(?), ref: 00F40863
LeaveCriticalSection.KERNEL32(?), ref: 00F408DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00F408F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00F40921

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: d3a28d0af9ef48e80770cd3745fb0db8528fb5906e7c78771a5468ff5903dfb6
Instruction ID: 8b9ac1c6ef9d631e47b2aa68783fd599631380b61835c154e03e9919d934dc73
Opcode Fuzzy Hash: d3a28d0af9ef48e80770cd3745fb0db8528fb5906e7c78771a5468ff5903dfb6
Instruction Fuzzy Hash: 54415E71900209EBDF149F55DC85A6A7BB8FF04310F1440A5ED00AA2A7DB70EE65EBA4

Function 00F681DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00F2F3AB,00000000,?,?,00000000,?,00F2682C,00000004,00000000,00000000), ref: 00F6824C
EnableWindow.USER32(?,00000000), ref: 00F68272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00F682D1
ShowWindow.USER32(?,00000004), ref: 00F682E5
EnableWindow.USER32(?,00000001), ref: 00F6830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00F6832F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: ea38265326bf15a11f529573e1a1d4fae2408fe52ca65459c163d7cead954435
Instruction ID: dd5e4dcdcdf529a048cf4601a7b908238baae426c69654e0152bc6db4edbdacc
Opcode Fuzzy Hash: ea38265326bf15a11f529573e1a1d4fae2408fe52ca65459c163d7cead954435
Instruction Fuzzy Hash: DF41C570A01648AFDB21CF15CCA9BE57BE0FB0A764F19436DE5584B262CB71A842EF50

Function 00F34C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00F34C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F34CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F34CEA
_wcslen.LIBCMT ref: 00F34D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F34D10
_wcsstr.LIBVCRUNTIME ref: 00F34D1A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 85a2b4c0424a9520bb0d80a45327e0247ae1c44f6176e2809d2f4905bdcb0428
Instruction ID: 56752c3b803e2c2d820813b4488cf4dd9eda37e834dd283bc00fb4e38ccddd68
Opcode Fuzzy Hash: 85a2b4c0424a9520bb0d80a45327e0247ae1c44f6176e2809d2f4905bdcb0428
Instruction Fuzzy Hash: 962129726042057BEB155B35EC09E7B7BDCDF45770F108029F809DA1A2EAA1FC00A6A0

Function 00F4581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED3A97,?,?,00ED2E7F,?,?,?,00000000), ref: 00ED3AC2

_wcslen.LIBCMT ref: 00F4587B
CoInitialize.OLE32(00000000), ref: 00F45995
CoCreateInstance.OLE32(00F6FCF8,00000000,00000001,00F6FB68,?), ref: 00F459AE
CoUninitialize.OLE32 ref: 00F459CC

Strings

.lnk, xrefs: 00F45876, 00F458C1, 00F45985

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: e21549efcee53bccd517b0e614047c1558cc7777d8fbc7594ac32e36a5ea24c7
Instruction ID: ea7b60c9c5c3d94195ae71acb764f5db180eee369e70e99b555eb0a4b26e1657
Opcode Fuzzy Hash: e21549efcee53bccd517b0e614047c1558cc7777d8fbc7594ac32e36a5ea24c7
Instruction Fuzzy Hash: 95D15571A08701DFC714EF24C480A2ABBE5EF89B24F14495DF8899B362DB31EC45DB92

Function 00F3175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F30FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F30FCA
Part of subcall function 00F30FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F30FD6
Part of subcall function 00F30FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F30FE5
Part of subcall function 00F30FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F30FEC
Part of subcall function 00F30FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F31002

GetLengthSid.ADVAPI32(?,00000000,00F31335), ref: 00F317AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F317BA
HeapAlloc.KERNEL32(00000000), ref: 00F317C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00F317DA
GetProcessHeap.KERNEL32(00000000,00000000,00F31335), ref: 00F317EE
HeapFree.KERNEL32(00000000), ref: 00F317F5

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 83b80d3d3f08ac712547760291371b7fbd2bdfd24e92fa0e307d4fb017f92a70
Instruction ID: c2f37a0b64b5dabe0257625821a6591cbba509e9bdc55806e3d50a5bc5c5a9c8
Opcode Fuzzy Hash: 83b80d3d3f08ac712547760291371b7fbd2bdfd24e92fa0e307d4fb017f92a70
Instruction Fuzzy Hash: 97118E32900209FFDB209FA4CC49BBF7BA9FB46365F184119F49197211D77AA944EBB0

Function 00F314CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F314FF
OpenProcessToken.ADVAPI32(00000000), ref: 00F31506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F31515
CloseHandle.KERNEL32(00000004), ref: 00F31520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F3154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00F31563

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 6b44f2936b7a2107c58854bff58bd5278c91d72607426933f28b4aee5ffe87ff
Instruction ID: 44e413c78027b6c3e6d1c58de4aa1dced3b2a813651030c187d7604e44d3457b
Opcode Fuzzy Hash: 6b44f2936b7a2107c58854bff58bd5278c91d72607426933f28b4aee5ffe87ff
Instruction Fuzzy Hash: 0211597250020DABDF11CF98DD49BEE7BA9FF49764F044015FA95A2160C3B18E60EBA0

Function 00EF3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00EF3379,00EF2FE5), ref: 00EF3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00EF339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00EF33B7
SetLastError.KERNEL32(00000000,?,00EF3379,00EF2FE5), ref: 00EF3409

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: aba2a28e5f8a35e0ed015a3df9baa5daa370a56b4a7bd0b8febba4243dff9c99
Instruction ID: c507616acfa497358faa3a46efb5aa52453f6480b8e6b4799ea29b16f355945b
Opcode Fuzzy Hash: aba2a28e5f8a35e0ed015a3df9baa5daa370a56b4a7bd0b8febba4243dff9c99
Instruction Fuzzy Hash: AF01243320A31DBEAA2567747C86A773ED4EB0537DB60222AF730E02F0EF514E116194

Function 00F02D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F05686,00F13CD6,?,00000000,?,00F05B6A,?,?,?,?,?,00EFE6D1,?,00F98A48), ref: 00F02D78
_free.LIBCMT ref: 00F02DAB
_free.LIBCMT ref: 00F02DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00EFE6D1,?,00F98A48,00000010,00ED4F4A,?,?,00000000,00F13CD6), ref: 00F02DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00EFE6D1,?,00F98A48,00000010,00ED4F4A,?,?,00000000,00F13CD6), ref: 00F02DEC
_abort.LIBCMT ref: 00F02DF2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 4ad9cc665e92777e9249ed0c48790646511de63cd6027b4f12056017a0d9acb6
Instruction ID: 3c3a6532aee50fcba7838f6b3b0eadcc090aba462ef5997e56b0f0b8ec062c9d
Opcode Fuzzy Hash: 4ad9cc665e92777e9249ed0c48790646511de63cd6027b4f12056017a0d9acb6
Instruction Fuzzy Hash: A7F0CD3690650067C6A237397C0EE1E365D6FC1775F354415F864921D2DE68CC017170

Function 00F68A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EE9693
Part of subcall function 00EE9639: SelectObject.GDI32(?,00000000), ref: 00EE96A2
Part of subcall function 00EE9639: BeginPath.GDI32(?), ref: 00EE96B9
Part of subcall function 00EE9639: SelectObject.GDI32(?,00000000), ref: 00EE96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00F68A4E
LineTo.GDI32(?,00000003,00000000), ref: 00F68A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00F68A70
LineTo.GDI32(?,00000000,00000003), ref: 00F68A80
EndPath.GDI32(?), ref: 00F68A90
StrokePath.GDI32(?), ref: 00F68AA0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: e7fdc2225c3f6593a0cbed9fdb6ae762690269bf155a7d199d62e0c3b471f9ac
Instruction ID: ab33122d6432ef8c4603edcc3f58006bc654debc4b3dd413d62f8071478586f1
Opcode Fuzzy Hash: e7fdc2225c3f6593a0cbed9fdb6ae762690269bf155a7d199d62e0c3b471f9ac
Instruction Fuzzy Hash: 3511097600014DFFDF129F94DC88EAA7FACEB08390F008012FA699A1A1C7719D55EBA0

Function 00F351FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F35218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F35229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F35230
ReleaseDC.USER32(00000000,00000000), ref: 00F35238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F3524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00F35261

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d471534f294b170ce6c84e3a5ef2c9e03fc6e3032dc63ba80b21fe3e73fca9a7
Instruction ID: 828654e781799caa917c228db51069442823076e21fe1852ae217839081883a5
Opcode Fuzzy Hash: d471534f294b170ce6c84e3a5ef2c9e03fc6e3032dc63ba80b21fe3e73fca9a7
Instruction Fuzzy Hash: 62016275E01718BBEB109BA59C49E5EBFB8EF48761F044066FA49E7281D6B1DC00DFA0

Function 00ED1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00ED1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00ED1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00ED1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00ED1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00ED1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00ED1C22

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 4c3224b0e7e9f1bf475be08068d13be393e6823eafd59037dceffe4edf63e05b
Instruction ID: bc72e9a3acc1946d024504ecf12baaf5cb09e241288932c9c864ed73892a688f
Opcode Fuzzy Hash: 4c3224b0e7e9f1bf475be08068d13be393e6823eafd59037dceffe4edf63e05b
Instruction Fuzzy Hash: 500167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BE15C4BA42C7F5A864CBE5

Function 00F3EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F3EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F3EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00F3EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F3EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F3EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F3EB75

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 4592c01941c76a88c9d10c13da2c85421a5dcf9fda3ac55eaa9a5e7131ef6c0e
Instruction ID: 96afd0186f5c883b6f60a2b021a372725cc85c858e49206bc16764875d3288c1
Opcode Fuzzy Hash: 4592c01941c76a88c9d10c13da2c85421a5dcf9fda3ac55eaa9a5e7131ef6c0e
Instruction Fuzzy Hash: 01F01D72540158BBE6216752DC0EEBF7A7CEFCAB11F000158F6A2D119196E15A01A6F5

Function 00F27439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00F27452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00F27469
GetWindowDC.USER32(?), ref: 00F27475
GetPixel.GDI32(00000000,?,?), ref: 00F27484
ReleaseDC.USER32(?,00000000), ref: 00F27496
GetSysColor.USER32(00000005), ref: 00F274B0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: cb927eeefb546717086f9df48e4507900540b17482ff2efb89fc884f140a728f
Instruction ID: 41184a9f823e7f4528cffa954610b1721e1e7c325fe531a6513fd35481da0704
Opcode Fuzzy Hash: cb927eeefb546717086f9df48e4507900540b17482ff2efb89fc884f140a728f
Instruction Fuzzy Hash: 4E01A231400219EFDB10AF64DC08BF97BB5FF04321F154060F9AAA21A1CB711D41FB90

Function 00F31874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F3187F
UnloadUserProfile.USERENV(?,?), ref: 00F3188B
CloseHandle.KERNEL32(?), ref: 00F31894
CloseHandle.KERNEL32(?), ref: 00F3189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00F318A5
HeapFree.KERNEL32(00000000), ref: 00F318AC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 611dd177edbddc9c858cca2bcf74306aca5996f970988b5929e0356f2e6ce7c3
Instruction ID: 1c0ff007bff107716fb8417eb6d2e671c113708a4aacbdbdb5300a9eafc42536
Opcode Fuzzy Hash: 611dd177edbddc9c858cca2bcf74306aca5996f970988b5929e0356f2e6ce7c3
Instruction Fuzzy Hash: 34E0ED36004109BBDB016FA2ED0C915BF39FF4A7227108221F2F581171CBB25420FFA0

Function 00F3C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7620: _wcslen.LIBCMT ref: 00ED7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F3C6EE
_wcslen.LIBCMT ref: 00F3C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F3C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F3C7CA

Strings

0, xrefs: 00F3C6AF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 134f9973a0e7e241a23cf5afc8ff35d28ac9458976c198b63e50af49abf33251
Instruction ID: 6efe83956483c4c5e5e9c2c72376fcfb38f4c914057ceb588d64b4b1e1f8394a
Opcode Fuzzy Hash: 134f9973a0e7e241a23cf5afc8ff35d28ac9458976c198b63e50af49abf33251
Instruction Fuzzy Hash: 5251B072A143019BD7149F28C885B6B77E8AF89330F040A2DF995F31E1DB60DD04EBA2

Function 00F5AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00F5AEA3

Part of subcall function 00ED7620: _wcslen.LIBCMT ref: 00ED7625

GetProcessId.KERNEL32(00000000), ref: 00F5AF38
CloseHandle.KERNEL32(00000000), ref: 00F5AF67

Strings

<, xrefs: 00F5AE6B
@, xrefs: 00F5AE72

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 0405fd057fc71ee57b304554109f2dfbda7836a1a1478dd6b96fe55cdf288478
Instruction ID: 296a24e099643acec392043d3cb6f8768caaa67d169ac12b2c3f8c1dfa848bd1
Opcode Fuzzy Hash: 0405fd057fc71ee57b304554109f2dfbda7836a1a1478dd6b96fe55cdf288478
Instruction Fuzzy Hash: 8A71AB70A00619CFCB14DF54D485A9EBBF0FF08310F04859AE956AB3A2DB70ED46DB91

Function 00F3719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F37206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F3723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F3724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F372CF

Strings

DllGetClassObject, xrefs: 00F37242

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 9171a7c7b1787c981a55b6767f80eff3e3044d831018a15b40f6d8c1984b61a4
Instruction ID: 313bdf079ca103ed12a6610c57b60132a1287439d0d6cd9904c018582fb8b08b
Opcode Fuzzy Hash: 9171a7c7b1787c981a55b6767f80eff3e3044d831018a15b40f6d8c1984b61a4
Instruction Fuzzy Hash: 49416CB1A04305EFDB25DF54C884A9B7BA9EF49320F1480A9BD059F24AD7B4D944EFA0

Function 00F63D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F63E35
IsMenu.USER32(?), ref: 00F63E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F63E92
DrawMenuBar.USER32 ref: 00F63EA5

Strings

0, xrefs: 00F63D89

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: da377fe7de1d1aedcf3d2fc3778d46280c59e9abc075d1231fca29c6809ee0e4
Instruction ID: ae9b61fc935a232cadf45fc6143c249519bcc3e541732353a9b105389d0131e2
Opcode Fuzzy Hash: da377fe7de1d1aedcf3d2fc3778d46280c59e9abc075d1231fca29c6809ee0e4
Instruction Fuzzy Hash: E74187B5A00209AFDB10DF50D880AAABBF9FF59360F044029F941A7250D735AE08EFA0

Function 00F31DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F31E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F31E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00F31EA9

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

Strings

ComboBox, xrefs: 00F31DF0
ListBox, xrefs: 00F31E25

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: e71b05bf2321d81ee713ce55a19aa03e87a1ef7b21c831d5747808203595259f
Instruction ID: d5c222562c768837927344171af65b93948da4a0e2d66bc477724b446b69bfcc
Opcode Fuzzy Hash: e71b05bf2321d81ee713ce55a19aa03e87a1ef7b21c831d5747808203595259f
Instruction Fuzzy Hash: 4B214771A00108BEDB14AB60DC45CFFB7F8EF41370F10411AF865A72E1DB7A5D4AA620

Function 00F5C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F5C9F1
_wcslen.LIBCMT ref: 00F5CA68
_wcslen.LIBCMT ref: 00F5CA9E
_wcslen.LIBCMT ref: 00F5CAF9
_wcslen.LIBCMT ref: 00F5CB2F
_wcslen.LIBCMT ref: 00F5CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00F5CA62, 00F5CA67
HKLM, xrefs: 00F5CA98, 00F5CA9D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 74cc27d49a5ff17b42ae2c8b3d7d1cb9df294f25ef736dc2e37e5c829c745003
Instruction ID: a455511cc06421f16f369a6b05665d11d6cc8d0830fd2762066216dd350da595
Opcode Fuzzy Hash: 74cc27d49a5ff17b42ae2c8b3d7d1cb9df294f25ef736dc2e37e5c829c745003
Instruction Fuzzy Hash: 2531C872E0036E4ECB20EE6C996017F3B919BA1761B154029EE466B245E679CD49F3D0

Function 00F62F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F62F8D
LoadLibraryW.KERNEL32(?), ref: 00F62F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F62FA9
DestroyWindow.USER32(?), ref: 00F62FB1

Strings

SysAnimate32, xrefs: 00F62F68

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 5b069315c3719b40dca26119625bf724a2a1a23d04ec72c37b5dae5c61238fdf
Instruction ID: 93320aa270841b595b69856333b5f478e4b8edbdd83e86e88ccab416b53aefc9
Opcode Fuzzy Hash: 5b069315c3719b40dca26119625bf724a2a1a23d04ec72c37b5dae5c61238fdf
Instruction Fuzzy Hash: 4E219D71704609ABEB504FA4DC80EBB37B9EB59374F104619F950D6190D7B1DC51A7A0

Function 00EF4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00EF4D1E,00F028E9,?,00EF4CBE,00F028E9,00F988B8,0000000C,00EF4E15,00F028E9,00000002), ref: 00EF4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00EF4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00EF4D1E,00F028E9,?,00EF4CBE,00F028E9,00F988B8,0000000C,00EF4E15,00F028E9,00000002,00000000), ref: 00EF4DC3

Strings

CorExitProcess, xrefs: 00EF4D98
mscoree.dll, xrefs: 00EF4D86

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 23633af44d2e69675f785500f3a884cb631c6cf521e0c6fbc6b86fef358da782
Instruction ID: ffdcb8702833e16eb271cd3a1796a3f76b3c77b7fa2124f8814ca1a9db0bd32c
Opcode Fuzzy Hash: 23633af44d2e69675f785500f3a884cb631c6cf521e0c6fbc6b86fef358da782
Instruction Fuzzy Hash: DFF0AF30A0020CBBDB149F90DC09BBEBBF4EF44716F0000A5F949A22A1CB719A40EBD1

Function 00ED4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00ED4EDD,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00ED4EAE
FreeLibrary.KERNEL32(00000000,?,?,00ED4EDD,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00ED4EA8
kernel32.dll, xrefs: 00ED4E94

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: d5ed050f3090fedf957cbdcb7ffe44abcd8288db9e6da76615eade3e7724bf6b
Instruction ID: 5ed4c10bd9f3aadc5b5f8b7907a8f1dc13a19d802180af79f909242959c548cf
Opcode Fuzzy Hash: d5ed050f3090fedf957cbdcb7ffe44abcd8288db9e6da76615eade3e7724bf6b
Instruction Fuzzy Hash: 7AE08635A015226B922117256C18A7B7654EF92B667090117FC80E6241DBB0CD0250E1

Function 00ED4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F13CDE,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00ED4E74
FreeLibrary.KERNEL32(00000000,?,?,00F13CDE,?,00FA1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00ED4E87

Strings

kernel32.dll, xrefs: 00ED4E5B
Wow64RevertWow64FsRedirection, xrefs: 00ED4E6E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 998bccd6e8ba0f07d0a2671a293d95d9a302c8fa757dcbb1a167a80854dedce7
Instruction ID: eb80d34e233b64ae3c0ef190be67be87155bae072bf050f83a0c65f6141c1d6f
Opcode Fuzzy Hash: 998bccd6e8ba0f07d0a2671a293d95d9a302c8fa757dcbb1a167a80854dedce7
Instruction Fuzzy Hash: E3D0C231502662675B221B24AC08DAB3B18EFC6B593050212FD80BA255CFB0CD02A1D0

Function 00F42947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F42C05
DeleteFileW.KERNEL32(?), ref: 00F42C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F42C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F42CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F42CC0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 3c595893c467b524d1dddffb3ac19b06613b9fbe10f102d37787d009c420778f
Instruction ID: 1a910116f2671dbb1e64733ff170afb86eb5e2605a95dd689701d52d904f8d7a
Opcode Fuzzy Hash: 3c595893c467b524d1dddffb3ac19b06613b9fbe10f102d37787d009c420778f
Instruction Fuzzy Hash: 2FB16E72D0011DABDF11DBA4CC85EEEBBBDEF48310F4040A6FA09E6251EA349A449F61

Function 00F5A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00F5A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F5A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F5A468
CloseHandle.KERNEL32(?), ref: 00F5A63D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 2d413ef6b56c0927eabd037991bf6c0c6854ebe2226ba491b41185b91d52837d
Instruction ID: 9700d1dcae2ffc8a92f43f6e46e2b97b14561103919073b2361bbb3b9c6d15d2
Opcode Fuzzy Hash: 2d413ef6b56c0927eabd037991bf6c0c6854ebe2226ba491b41185b91d52837d
Instruction Fuzzy Hash: 7DA18C716043019FD720DF24C886B2AB7E5EF84714F14991DFAAA9B392D7B0EC45CB92

Function 00F3E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F3CF22,?), ref: 00F3DDFD

Part of subcall function 00F3DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F3CF22,?), ref: 00F3DE16

Part of subcall function 00F3E199: GetFileAttributesW.KERNEL32(?,00F3CF95), ref: 00F3E19A

lstrcmpiW.KERNEL32(?,?), ref: 00F3E473
MoveFileW.KERNEL32(?,?), ref: 00F3E4AC
_wcslen.LIBCMT ref: 00F3E5EB
_wcslen.LIBCMT ref: 00F3E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00F3E650

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 02fca75195916f259c747a76a6697cc6167971ef3ab69c1258304e0f1565e8f4
Instruction ID: 476673411512ea2ee72943e626caec0e19bf878ebc94b185ace249b7c23cef7a
Opcode Fuzzy Hash: 02fca75195916f259c747a76a6697cc6167971ef3ab69c1258304e0f1565e8f4
Instruction Fuzzy Hash: 995184B25083459BC724EB90DC819EFB7ECAF84360F00491EF6C9D3191EF75A6889766

Function 00F5B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F5C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F5B6AE,?,?), ref: 00F5C9B5
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5C9F1
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA68
Part of subcall function 00F5C998: _wcslen.LIBCMT ref: 00F5CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F5BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F5BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F5BB63
RegCloseKey.ADVAPI32(?,?), ref: 00F5BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00F5BBB3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 83296630c47b20d0cfe0169186a9a126243174858d6d92dd8a880735873db7a0
Instruction ID: 57ae4b7f79c5ff8aeb1773684dfd3f2423148935a2b2fe8c69ae6d25557e3293
Opcode Fuzzy Hash: 83296630c47b20d0cfe0169186a9a126243174858d6d92dd8a880735873db7a0
Instruction Fuzzy Hash: F061D431608241EFD314DF14C890E2ABBE5FF84318F14855DF9998B2A2DB35ED4ADB92

Function 00F38BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F38BCD
VariantClear.OLEAUT32 ref: 00F38C3E
VariantClear.OLEAUT32 ref: 00F38C9D
VariantClear.OLEAUT32(?), ref: 00F38D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F38D3B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: ace23f4205ed1a99c295cc1d6da71c305dd5df8a643941c559c856d5faa1cd4e
Instruction ID: 99eac1411064a94403a897d7ac2450a8b1a0e4b2e5146c4d195d4d825357af65
Opcode Fuzzy Hash: ace23f4205ed1a99c295cc1d6da71c305dd5df8a643941c559c856d5faa1cd4e
Instruction Fuzzy Hash: 8C516BB5A00219EFCB10CF58C884AAAB7F4FF89360F158559F955DB350EB34E912CBA0

Function 00F48AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F48BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00F48BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F48C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F48C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F48C5F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 39f7ef1ab2296717a91827bd0b0bb7eae4688e156979181383a93fc1c9931651
Instruction ID: 0d25d11451f652fb5c5193a1356e51fc6b9ab8564a09a798c28d06848fbe9910
Opcode Fuzzy Hash: 39f7ef1ab2296717a91827bd0b0bb7eae4688e156979181383a93fc1c9931651
Instruction Fuzzy Hash: 18515A35A002199FCB04DF65C880A6DBBF5FF48354F088459E949AB3A2DB31ED42DB91

Function 00F58EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00F58F40
GetProcAddress.KERNEL32(00000000,?), ref: 00F58FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00F58FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00F59032
FreeLibrary.KERNEL32(00000000), ref: 00F59052

Part of subcall function 00EEF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00F41043,?,753CE610), ref: 00EEF6E6
Part of subcall function 00EEF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00F2FA64,00000000,00000000,?,?,00F41043,?,753CE610,?,00F2FA64), ref: 00EEF70D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: c6fc5d21fc27b44bd00e10dcbe4822ad00d0dba0197d43a317560b5b13b36715
Instruction ID: a5905f9ad04741839716697953f4e7029167cd7581caae530e5bbe07f678980e
Opcode Fuzzy Hash: c6fc5d21fc27b44bd00e10dcbe4822ad00d0dba0197d43a317560b5b13b36715
Instruction Fuzzy Hash: A9516A35A04205DFC704DF68C4848ADBBF1FF49324B058099ED5AAB362DB31ED8ADB90

Function 00F66B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00F66C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00F66C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00F66C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00F4AB79,00000000,00000000), ref: 00F66C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00F66CC7

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 077c02c3c8541cf6caa7884aff8e2fb299a4bd75210e293d7fabcded808f0d68
Instruction ID: 4b3f1f698752a0d257af493a555ce93ecaedf59962459c4dbcfd39c35b80045d
Opcode Fuzzy Hash: 077c02c3c8541cf6caa7884aff8e2fb299a4bd75210e293d7fabcded808f0d68
Instruction Fuzzy Hash: 2341B635A04504AFD724DF28CD54FB57BA5EB49361F150268F899E73E0C371AD41EA90

Function 00F02051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F020C3
_free.LIBCMT ref: 00F020E3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 653d12fa448bc2994f2fd75567d863d9f26881bd1ac31d24d0f5116ba2b019de
Instruction ID: 566ce212fafe736c03a264a168393b0a431d349b60e43c51a3b845686d8a19f1
Opcode Fuzzy Hash: 653d12fa448bc2994f2fd75567d863d9f26881bd1ac31d24d0f5116ba2b019de
Instruction Fuzzy Hash: 8941E232E002049FCB20DF78C884A5DB3F5EF89724F1545A9E615EB3A1DB31AD01EBA0

Function 00EE912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00EE9141
ScreenToClient.USER32(00000000,?), ref: 00EE915E
GetAsyncKeyState.USER32(00000001), ref: 00EE9183
GetAsyncKeyState.USER32(00000002), ref: 00EE919D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: b435577957284cc726dbc016fe4ef1becb48ebccd1f427c47fd9209e73449089
Instruction ID: 95f574c9f9ccb66becae36da2f69482328b30c8b86a28852957474e87bf83696
Opcode Fuzzy Hash: b435577957284cc726dbc016fe4ef1becb48ebccd1f427c47fd9209e73449089
Instruction Fuzzy Hash: EA417F31A0861AFBDF09AF65D844BEEB7B4FF05324F208219E469A3291C7346950DB91

Function 00F43874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00F438CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00F43922
TranslateMessage.USER32(?), ref: 00F4394B
DispatchMessageW.USER32(?), ref: 00F43955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F43966

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 8f813a64b6c799ee9031874d7cfa646409fd243c776496caca6b76e662a7a2bd
Instruction ID: c1df5f1b259eb5fb9bb0e234ebaf95ffef48326934c87be2cab3fd5892d68df1
Opcode Fuzzy Hash: 8f813a64b6c799ee9031874d7cfa646409fd243c776496caca6b76e662a7a2bd
Instruction Fuzzy Hash: 1D31A8B1D043499EFB35CB359C48BB77FA9BB06314F040559D8A2821A0E7F49A84FB51

Function 00F4CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00F4C21E,00000000), ref: 00F4CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00F4CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00F4C21E,00000000), ref: 00F4CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00F4C21E,00000000), ref: 00F4CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00F4C21E,00000000), ref: 00F4CFF2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 43a11eec42db28053f44c4c63df37a049361c071b2415c55edc604e2e296da0b
Instruction ID: 9ea5593743f955f1cdf47d37e9263037bf83ef0a19780596a4881fd942876d6b
Opcode Fuzzy Hash: 43a11eec42db28053f44c4c63df37a049361c071b2415c55edc604e2e296da0b
Instruction Fuzzy Hash: DD318271901209EFDB60DFA5C884AABBFF9EB14320B10442EF956D3101D734AD44EBB0

Function 00F31901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F31915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00F319C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00F319C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00F319DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00F319E2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: e32cf225bf35f94b056a654a401b9dccdba41b2f529d5089b649104c9cdac24b
Instruction ID: 0588a6a6a8ef255290f85b3777c878847f0f71c10aa144e904218e10bc99bd39
Opcode Fuzzy Hash: e32cf225bf35f94b056a654a401b9dccdba41b2f529d5089b649104c9cdac24b
Instruction Fuzzy Hash: ED31AF72900219EFCB14CFA8CD99BEE3BB5FB05325F104225F965A72D1C7B09954EB90

Function 00F65706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00F65745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00F6579D
_wcslen.LIBCMT ref: 00F657AF
_wcslen.LIBCMT ref: 00F657BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F65816

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 038805fea6aa689d2cb741d91a3e7d4525e99a4f315376efde44a693b4998afe
Instruction ID: 13b98d34078f10aa4ab0391bcf414884be055f1b7624971adbbe38244f3a3cbf
Opcode Fuzzy Hash: 038805fea6aa689d2cb741d91a3e7d4525e99a4f315376efde44a693b4998afe
Instruction Fuzzy Hash: 22219171D0461D9ADB20DFA0CC84AEE77B8FF04B24F108256E969FA181DBB08985DF50

Function 00F50930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00F50951
GetForegroundWindow.USER32 ref: 00F50968
GetDC.USER32(00000000), ref: 00F509A4
GetPixel.GDI32(00000000,?,00000003), ref: 00F509B0
ReleaseDC.USER32(00000000,00000003), ref: 00F509E8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5447047f3c5cbf989b1a1dd89fb673e08319c0f0b79fa7c7adb315c4d6fbd41e
Instruction ID: f06b5c69a14cc155aefcb064eb3a1b1698c04b9cd3a81bbda0ebce4c9d210099
Opcode Fuzzy Hash: 5447047f3c5cbf989b1a1dd89fb673e08319c0f0b79fa7c7adb315c4d6fbd41e
Instruction Fuzzy Hash: 95218135600204AFD714EF65DC84AAEBBE9FF44701F048069F89AE7362DB70AC44DB90

Function 00F0CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F0CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F0CDE9

Part of subcall function 00F03820: RtlAllocateHeap.NTDLL(00000000,?,00FA1444,?,00EEFDF5,?,?,00EDA976,00000010,00FA1440,00ED13FC,?,00ED13C6,?,00ED1129), ref: 00F03852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F0CE0F
_free.LIBCMT ref: 00F0CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F0CE31

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: f0160a7890200416b9ba670bb1c796aa33906fc189ea24c2fc01f19b03589d44
Instruction ID: 049b0197a63c1f104a8d0a13a53e93bc0fcfc652b4e3aed0704c530c6aafe7ea
Opcode Fuzzy Hash: f0160a7890200416b9ba670bb1c796aa33906fc189ea24c2fc01f19b03589d44
Instruction Fuzzy Hash: 1901D472A022157FA32127BAAC8CD7F796DDFC6BA1315022AFD05C7280EA608D01B1F0

Function 00EE9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EE9693
SelectObject.GDI32(?,00000000), ref: 00EE96A2
BeginPath.GDI32(?), ref: 00EE96B9
SelectObject.GDI32(?,00000000), ref: 00EE96E2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e2da9afddd50d29e2fd2ba92030543713313c772f1468efe0924e9e268e3d4d8
Instruction ID: e834fd67bb231d7ebc05e603c62d9656da12b7915afc6d8a2621b92fe534e998
Opcode Fuzzy Hash: e2da9afddd50d29e2fd2ba92030543713313c772f1468efe0924e9e268e3d4d8
Instruction Fuzzy Hash: 222180B080238EEBDB119F65EC147EA3BB8BB06365F110216F460A61B2D3B05995EB94

Function 00EE990E Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00EE98CC
SetTextColor.GDI32(?,?), ref: 00EE98D6
SetBkMode.GDI32(?,00000001), ref: 00EE98E9
GetStockObject.GDI32(00000005), ref: 00EE98F1
GetWindowLongW.USER32(?,000000EB), ref: 00EE9952

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 98b6492d5915add697d2f53089febf79d1e74ada42a21866184d593905be2114
Instruction ID: 9253d905386431f152d9874e61cf735dfaede5977c31cb1774970d8f7ea96138
Opcode Fuzzy Hash: 98b6492d5915add697d2f53089febf79d1e74ada42a21866184d593905be2114
Instruction Fuzzy Hash: 3C1136315452D89FCB218B22EC55AFA3BA0EB53334F09015EE5E2AA1B3C6760940DB91

Function 00F35711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00F35726
_memcmp.LIBVCRUNTIME ref: 00F35744
_memcmp.LIBVCRUNTIME ref: 00F35757
_memcmp.LIBVCRUNTIME ref: 00F3576F
_memcmp.LIBVCRUNTIME ref: 00F35787

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: dd1e3beff65336a4d0f59764905b00466c92c0832d194b53239e64d9cd934e9a
Instruction ID: 532fd16d162095edb11307af17ac50357a28669189b1e656e2936efaaba74aa1
Opcode Fuzzy Hash: dd1e3beff65336a4d0f59764905b00466c92c0832d194b53239e64d9cd934e9a
Instruction Fuzzy Hash: 0001D862A4660DFBD2085510AD82FBB739D9FB1BB4F414020FE04AF241F760ED14E2E1

Function 00F02DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00EFF2DE,00F03863,00FA1444,?,00EEFDF5,?,?,00EDA976,00000010,00FA1440,00ED13FC,?,00ED13C6), ref: 00F02DFD
_free.LIBCMT ref: 00F02E32
_free.LIBCMT ref: 00F02E59
SetLastError.KERNEL32(00000000,00ED1129), ref: 00F02E66
SetLastError.KERNEL32(00000000,00ED1129), ref: 00F02E6F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 8513d7cb27a0ac3dd65e871e3bfb15bef64368a2e40b7d8153bc4b701923bb57
Instruction ID: 184b446fbd01da4a5e902e15b7dcfc07e6591f2d7377f12ea824deea8d5f08a2
Opcode Fuzzy Hash: 8513d7cb27a0ac3dd65e871e3bfb15bef64368a2e40b7d8153bc4b701923bb57
Instruction Fuzzy Hash: B701287768560467C6623735EC8EE2B366DAFD17B1B614029F865A22D2EF78CC017170

Function 00F3000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?,?,00F3035E), ref: 00F3002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?), ref: 00F30046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?), ref: 00F30054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?), ref: 00F30064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F2FF41,80070057,?,?), ref: 00F30070

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 233af84129cd90a3a7801688742f82da774381627ffa2cc6786919df82544560
Instruction ID: e0a746b10509bbe1307bfdeee4d5b0a95191e6f44fa2ce0e6efb4e25f67a9289
Opcode Fuzzy Hash: 233af84129cd90a3a7801688742f82da774381627ffa2cc6786919df82544560
Instruction Fuzzy Hash: B901A2B2600218BFDB245F68DC44BBE7AEDEF44761F144125F985D3210DBB5DD40ABA0

Function 00F3E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00F3E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00F3E9A5
Sleep.KERNEL32(00000000), ref: 00F3E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00F3E9B7
Sleep.KERNEL32 ref: 00F3E9F3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: f49720ec7fba4fa7d41a7484d1811c85f73e519a85b55a00f18f5dc1056fb5a4
Instruction ID: be7c05306afa43646a545ce5c30b76d3bddae01dee9eb4342272207ba7d487a7
Opcode Fuzzy Hash: f49720ec7fba4fa7d41a7484d1811c85f73e519a85b55a00f18f5dc1056fb5a4
Instruction Fuzzy Hash: D1015731C0262DDBCF00ABE5DC59BEDBB78BF0A321F000546E992B2281CB709551ABA1

Function 00F310F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F31114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F31120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F3112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F30B9B,?,?,?), ref: 00F31136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F3114D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 84efdd03a9ebf519c9472990720fe812173e5f342777285e3490c38d417016c7
Instruction ID: c8668d882db58eb71805bd24d05f66f4eec7898d679c2c7b8043f20100b1f969
Opcode Fuzzy Hash: 84efdd03a9ebf519c9472990720fe812173e5f342777285e3490c38d417016c7
Instruction Fuzzy Hash: 8C011D75600209BFDB115F65DC49AAA3B6EFF85370B114415FA95D7360DA71DC00AAA0

Function 00F30FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F30FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F30FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F30FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F30FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F31002

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 6c2d3af0999251e010d25cf5962fbba6b497d2ba73c896b3541776c78de50d50
Instruction ID: b27fb2d2fff1c0987c5b9128de57c234bb0b476f9ee627bb916e289c9869d7d6
Opcode Fuzzy Hash: 6c2d3af0999251e010d25cf5962fbba6b497d2ba73c896b3541776c78de50d50
Instruction Fuzzy Hash: CEF04975600309BBDB214FA59C49F663BADFF8A762F104414FAD9D6251CAB1DC40AAA0

Function 00F31014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F3102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F31036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F31045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F3104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F31062

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f505db8e4fa14ff44d7f2fcb9c6962d9697b6fa9c33d64707f8b5497684fd9d3
Instruction ID: 0a0461aca7b3fbfb535ca7a860fd53d42d266fed3f4bbf14381aca1764e520c7
Opcode Fuzzy Hash: f505db8e4fa14ff44d7f2fcb9c6962d9697b6fa9c33d64707f8b5497684fd9d3
Instruction Fuzzy Hash: 67F06D75200309FBDB215FA5EC59F663BADFF8A771F100414FAD9D7251CAB1D840AAA0

Function 00F4030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00F4017D,?,00F432FC,?,00000001,00F12592,?), ref: 00F40324
CloseHandle.KERNEL32(?,?,?,?,00F4017D,?,00F432FC,?,00000001,00F12592,?), ref: 00F40331
CloseHandle.KERNEL32(?,?,?,?,00F4017D,?,00F432FC,?,00000001,00F12592,?), ref: 00F4033E
CloseHandle.KERNEL32(?,?,?,?,00F4017D,?,00F432FC,?,00000001,00F12592,?), ref: 00F4034B
CloseHandle.KERNEL32(?,?,?,?,00F4017D,?,00F432FC,?,00000001,00F12592,?), ref: 00F40358
CloseHandle.KERNEL32(?,?,?,?,00F4017D,?,00F432FC,?,00000001,00F12592,?), ref: 00F40365

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a7b740262cfbd3b3d1b8bbc60b5dcaba4f2b1e9cdc447d375e988682e590da09
Instruction ID: c921a9501c774f8bbea7a3c6ebf5bd1cbd34d26dabeebd8627e365fc487852c0
Opcode Fuzzy Hash: a7b740262cfbd3b3d1b8bbc60b5dcaba4f2b1e9cdc447d375e988682e590da09
Instruction Fuzzy Hash: 4B01A272800B159FD7309F66D890422FBF5BF503253158A3FD29652931C7B1A954EF80

Function 00F0D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F0D752

Part of subcall function 00F029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000), ref: 00F029DE
Part of subcall function 00F029C8: GetLastError.KERNEL32(00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000,00000000), ref: 00F029F0

_free.LIBCMT ref: 00F0D764
_free.LIBCMT ref: 00F0D776
_free.LIBCMT ref: 00F0D788
_free.LIBCMT ref: 00F0D79A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b31ddb5fd3ca13e2131f3386700a4e0f8d2fc59d7103add2c959ebc88d99c56a
Instruction ID: d271168171120ace1f891cf969711c30561209c59c63018195638c5c8b583f17
Opcode Fuzzy Hash: b31ddb5fd3ca13e2131f3386700a4e0f8d2fc59d7103add2c959ebc88d99c56a
Instruction Fuzzy Hash: E3F01232944208ABC665EBADFDC5C167BEDBB447207E40806F048E7581C734FC80B6B4

Function 00F35C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00F35C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00F35C6F
MessageBeep.USER32(00000000), ref: 00F35C87
KillTimer.USER32(?,0000040A), ref: 00F35CA3
EndDialog.USER32(?,00000001), ref: 00F35CBD

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 45ee75563f9c04437155c5c270b1bb4624aafb4f391c7f4c069b29d9bf967c42
Instruction ID: d1b457d5c0639bf708f27b9f68d113cc80469c6c57eea428977168a004a9451a
Opcode Fuzzy Hash: 45ee75563f9c04437155c5c270b1bb4624aafb4f391c7f4c069b29d9bf967c42
Instruction Fuzzy Hash: A401D630500B08ABEB205B20DD4EFA677B8FB00F59F00115AE1D3A14E0DBF1A984EA90

Function 00F022A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F022BE

Part of subcall function 00F029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000), ref: 00F029DE
Part of subcall function 00F029C8: GetLastError.KERNEL32(00000000,?,00F0D7D1,00000000,00000000,00000000,00000000,?,00F0D7F8,00000000,00000007,00000000,?,00F0DBF5,00000000,00000000), ref: 00F029F0

_free.LIBCMT ref: 00F022D0
_free.LIBCMT ref: 00F022E3
_free.LIBCMT ref: 00F022F4
_free.LIBCMT ref: 00F02305

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d51ae1162c5df162b3fd8ed4891360da54494411d03768e8c6bde801fc91edd0
Instruction ID: 27302a197005ae603480d13295af77566918577ba91f133bb5a85979d85119a1
Opcode Fuzzy Hash: d51ae1162c5df162b3fd8ed4891360da54494411d03768e8c6bde801fc91edd0
Instruction Fuzzy Hash: 6DF03AB48101288FCA52BF58BC059493BA4F75A760B91050BF410E32F1CB344811BBF4

Function 00EE95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00EE95D4
StrokeAndFillPath.GDI32(?,?,00F271F7,00000000,?,?,?), ref: 00EE95F0
SelectObject.GDI32(?,00000000), ref: 00EE9603
DeleteObject.GDI32 ref: 00EE9616
StrokePath.GDI32(?), ref: 00EE9631

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: bbacf0786b6e94586c82a5fd221aee790d2f29cd4a14cb2704e82d5a334ca868
Instruction ID: 5a49c492e8fb3781c0442c67d8400ac4ac235834e1c50d65a785e74b028201d5
Opcode Fuzzy Hash: bbacf0786b6e94586c82a5fd221aee790d2f29cd4a14cb2704e82d5a334ca868
Instruction Fuzzy Hash: 41F0877000624CEBCB225F2AED1CBB63BA0BB0A366F008215F4B5A50F1C7708995EF60

Function 00F00F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00F010F9
__freea.LIBCMT ref: 00F01117

Part of subcall function 00F01537: _free.LIBCMT ref: 00F0154F

Strings

a/p, xrefs: 00F011DE
am/pm, xrefs: 00F0117A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 364dba271ddc865a8e9ca4d9f7c90abe1aeb0aa4a0710e78510f4119e06e5034
Instruction ID: 0faff6c551cc19507cf3301cdc6e0836a77b8369e3f2b479b304d6a0e13d93ac
Opcode Fuzzy Hash: 364dba271ddc865a8e9ca4d9f7c90abe1aeb0aa4a0710e78510f4119e06e5034
Instruction Fuzzy Hash: BAD11432E00206DADB289F68C895BFEB7B5FF05320F284159E941AB6D0D3759D80FB91

Function 00F57B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00EF0242: EnterCriticalSection.KERNEL32(00FA070C,00FA1884,?,?,00EE198B,00FA2518,?,?,?,00ED12F9,00000000), ref: 00EF024D
Part of subcall function 00EF0242: LeaveCriticalSection.KERNEL32(00FA070C,?,00EE198B,00FA2518,?,?,?,00ED12F9,00000000), ref: 00EF028A

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00EF00A3: __onexit.LIBCMT ref: 00EF00A9

__Init_thread_footer.LIBCMT ref: 00F57BFB

Part of subcall function 00EF01F8: EnterCriticalSection.KERNEL32(00FA070C,?,?,00EE8747,00FA2514), ref: 00EF0202
Part of subcall function 00EF01F8: LeaveCriticalSection.KERNEL32(00FA070C,?,00EE8747,00FA2514), ref: 00EF0235

Strings

G, xrefs: 00F57C7F
Variable must be of type 'Object'., xrefs: 00F57C3A
5, xrefs: 00F57C78

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 48aed98eb708cac4b269a873e181e3bbcfe550977dc51bbe4f6c44c0305eb13f
Instruction ID: 9364032f943da570bcb040b09c42bf3ed38340bbc01d5d5271ff304d3883af44
Opcode Fuzzy Hash: 48aed98eb708cac4b269a873e181e3bbcfe550977dc51bbe4f6c44c0305eb13f
Instruction Fuzzy Hash: E3919970A04209AFCB04EF54E8959BDB7B1FF49311F148059FE06AB292DB31AE49EB51

Function 00F05AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO, xrefs: 00F05BA8, 00F05C6C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: JO
API String ID: 0-1663374661
Opcode ID: 4996a497921dc3bef1af490a91f6f6028fabeb8bab3d59e44f69554e6b410651
Instruction ID: 6aa7254ad2d24a8a183b16c42d80a18d19ed664b2e1ed3a192e461e1f06b519e
Opcode Fuzzy Hash: 4996a497921dc3bef1af490a91f6f6028fabeb8bab3d59e44f69554e6b410651
Instruction Fuzzy Hash: 7F51BEB1E006099FEB219FB4C845BBFBBB8AF45B20F14405AF405A72E1D6B59901FF61

Function 00F08A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00F08B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00F08B7A
__dosmaperr.LIBCMT ref: 00F08B81

Strings

., xrefs: 00F08A63

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .
API String ID: 2434981716-3963672497
Opcode ID: 78d90aa5cbf36cb1da0b577ad4241a827d6aa0c427db8a153bb4dff4d11bdde6
Instruction ID: 3235d9564bd05f3ae5dee89cb868f8da378b80843707a8f7d8aafa58655a3aee
Opcode Fuzzy Hash: 78d90aa5cbf36cb1da0b577ad4241a827d6aa0c427db8a153bb4dff4d11bdde6
Instruction Fuzzy Hash: E3417BF1A04159AFDB249F24CC80A797FA6DFC6390F2881A9F4C597692DE318C03B790

Function 00F32716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F321D0,?,?,00000034,00000800,?,00000034), ref: 00F3B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F32760

Part of subcall function 00F3B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F321FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00F3B3F8

Part of subcall function 00F3B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00F3B355
Part of subcall function 00F3B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F32194,00000034,?,?,00001004,00000000,00000000), ref: 00F3B365
Part of subcall function 00F3B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F32194,00000034,?,?,00001004,00000000,00000000), ref: 00F3B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F327CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F3281A

Strings

@, xrefs: 00F32832

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3fe30c7df815f6941af91f3db5db4b647d5c6c10998a7d68bb124f114badf884
Instruction ID: f7e9378caa742e54a48f9a01b3210fe10fcb420b8736a14e063d6f7049dbb595
Opcode Fuzzy Hash: 3fe30c7df815f6941af91f3db5db4b647d5c6c10998a7d68bb124f114badf884
Instruction Fuzzy Hash: CB413972900218BFDB10DFA4CD95AEEBBB8EF09710F104099FA95B7181DB716E45DBA0

Function 00F0172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00F01769
_free.LIBCMT ref: 00F01834
_free.LIBCMT ref: 00F0183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00F01760, 00F01767, 00F01796, 00F017CE

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 188e93b5526dc79b2d56bf5d7ec97337b8b96ac3b4920169b4bd076acda8d290
Instruction ID: b96e24d3b5242b07a549ec0fd2694671486083ed916e6f25dcdbe627224eedd8
Opcode Fuzzy Hash: 188e93b5526dc79b2d56bf5d7ec97337b8b96ac3b4920169b4bd076acda8d290
Instruction Fuzzy Hash: 4A314F75E40218EBDB21DF999C85E9EBBFCFB85360F144166F50497291D6708E40FBA0

Function 00F3C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F3C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00F3C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00FA1990,009A6A00), ref: 00F3C395

Strings

0, xrefs: 00F3C2DF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: c764c664c3dbe82a7f7316a5786499ac076597ea3ec636fb5d8638ab47115157
Instruction ID: 236da25ec2eaad0823e019c3a9b6fdda276fba457f0afa4d1594e16380444ead
Opcode Fuzzy Hash: c764c664c3dbe82a7f7316a5786499ac076597ea3ec636fb5d8638ab47115157
Instruction Fuzzy Hash: 02418E726043019FD720DF25DC84B6ABBE4EF85330F148A1EF9A5A7291D774E904EB92

Function 00F64416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00F6CC08,00000000,?,?,?,?), ref: 00F644AA
GetWindowLongW.USER32 ref: 00F644C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F644D7

Strings

SysTreeView32, xrefs: 00F6447C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 51ddb404c6b0e38af45f17c5539c71651fd2d2c987a16e2b90bd7f71fc5eba80
Instruction ID: 20e1bef4c8dd1355e761947ac78f189387ba6b854f30d93ecc88b456b38a41fd
Opcode Fuzzy Hash: 51ddb404c6b0e38af45f17c5539c71651fd2d2c987a16e2b90bd7f71fc5eba80
Instruction Fuzzy Hash: BD31B031610209AFDF21AE38DC46BEA7BA9EB09334F244315F975A31D1DB70EC51AB50

Function 00F5304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00F53077,?,?), ref: 00F53378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00F5307A
_wcslen.LIBCMT ref: 00F5309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00F53106

Strings

255.255.255.255, xrefs: 00F53095, 00F5309A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: eb700ab867491b09eb047365a4c506948f56da77fa839b6e34b7f44b0f6c378b
Instruction ID: fb66b09c8d748b104fc79a38832f076b92487c09bde2329b0c3c9f9a405eb2b0
Opcode Fuzzy Hash: eb700ab867491b09eb047365a4c506948f56da77fa839b6e34b7f44b0f6c378b
Instruction Fuzzy Hash: 8C31B436A042059FC710CF2CC485A6A77E0EF54369F248059EA158B392D771DE49E760

Function 00F63EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F63F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F63F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F63F78

Strings

SysMonthCal32, xrefs: 00F63F0B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 44a7db8af1fa964d6f7e3f27ab200981c0ad97c784b0a850d0ae371391a14fba
Instruction ID: faf7e81cf6be6fffb4a0df5d9998fe2658e37a406b1fb89ca1e92268279c54c3
Opcode Fuzzy Hash: 44a7db8af1fa964d6f7e3f27ab200981c0ad97c784b0a850d0ae371391a14fba
Instruction Fuzzy Hash: 9321D132A00219BFDF259F50CC46FEA3BB9EF48724F110214FA556B1D0D6B6AC50EBA0

Function 00F64653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00F64705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00F64713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F6471A

Strings

msctls_updown32, xrefs: 00F64684

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: a155ba941ca4b0720ce9c615ee9b165989057eb428393b6aa329c7c4c3abbf98
Instruction ID: 0cf4b129653f79541fdef176dc9435b566d79643f73929d8135b68f9f05c60b6
Opcode Fuzzy Hash: a155ba941ca4b0720ce9c615ee9b165989057eb428393b6aa329c7c4c3abbf98
Instruction Fuzzy Hash: 1A215EB5600209AFEB10EF64DC91DB737ADEB5A3A4B140059FA109B261CB71FC51EA60

Function 00F395AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F3961D

Strings

#requireadmin, xrefs: 00F395D9
#notrayicon, xrefs: 00F395B7
#OnAutoItStartRegister, xrefs: 00F395F3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: a5b8b331a28e44e086009be02aef357f82b24f9c6dc25f4f14bcdf46b0e216b2
Instruction ID: cc64befd0d9e64455cc3065337bf7101544972d00a176b8d1416151dc9a9a2e8
Opcode Fuzzy Hash: a5b8b331a28e44e086009be02aef357f82b24f9c6dc25f4f14bcdf46b0e216b2
Instruction Fuzzy Hash: C1215B7260961166C331AB24DC03FB773D8DF91330F544026F95AA7181EBD1ED85E2A5

Function 00F637B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F63840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F63850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F63876

Strings

Listbox, xrefs: 00F6380F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 7fc049697bb6234174a8540ed459789052a572b6efa83c86bfbc8a9af5ae9619
Instruction ID: b2b0c70c5a8d3f882a3ec13e0e17e735380cf8533edfefa96c1b861da5fd534a
Opcode Fuzzy Hash: 7fc049697bb6234174a8540ed459789052a572b6efa83c86bfbc8a9af5ae9619
Instruction Fuzzy Hash: 0121C272A14218BBEF219F64CC41FFB376EEF89760F118114F9549B190C6B5DC52A7A0

Function 00F449F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F44A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F44A5C
SetErrorMode.KERNEL32(00000000,?,?,00F6CC08), ref: 00F44AD0

Strings

%lu, xrefs: 00F44A6F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 95dd04694e7b9f80abcea86c082543d4a453669fe2d0c947f0c4b44c1b1f81bc
Instruction ID: e1c2093bbf18cd0b5cceb5d2e766a71a4797697c42e35533630a6606ae9f82fb
Opcode Fuzzy Hash: 95dd04694e7b9f80abcea86c082543d4a453669fe2d0c947f0c4b44c1b1f81bc
Instruction Fuzzy Hash: AD31A571A00108AFDB10DF54C885EAA7BF8EF04308F144095F945EB352DB75ED46DBA1

Function 00F641EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00F6424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00F64264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00F64271

Strings

msctls_trackbar32, xrefs: 00F64226

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: f6b984332b754dbe30149b668aaca3316ff278716418269edecb82d56327b93b
Instruction ID: a709cb87ded78dd46a6c2c5e6d1541a5c2801517207e73bd26870628675ba511
Opcode Fuzzy Hash: f6b984332b754dbe30149b668aaca3316ff278716418269edecb82d56327b93b
Instruction Fuzzy Hash: 3B110631640208BEEF206F28CC46FAB3BACEF85B64F110114FA55E2090D2B1EC51AB14

Function 00F32F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED6B57: _wcslen.LIBCMT ref: 00ED6B6A

Part of subcall function 00F32DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F32DC5
Part of subcall function 00F32DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F32DD6
Part of subcall function 00F32DA7: GetCurrentThreadId.KERNEL32 ref: 00F32DDD
Part of subcall function 00F32DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F32DE4

GetFocus.USER32 ref: 00F32F78

Part of subcall function 00F32DEE: GetParent.USER32(00000000), ref: 00F32DF9

GetClassNameW.USER32(?,?,00000100), ref: 00F32FC3
EnumChildWindows.USER32(?,00F3303B), ref: 00F32FEB

Strings

%s%d, xrefs: 00F32FFF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: a77c8ed2eedee6d9c287d173406ab5fb361413f875210495ee7022050f6f0d62
Instruction ID: d65d4b3e80add4dc086f7278713f798de72203d2ff8d27e551a6445f4e6fd37a
Opcode Fuzzy Hash: a77c8ed2eedee6d9c287d173406ab5fb361413f875210495ee7022050f6f0d62
Instruction Fuzzy Hash: 7B11E4B16002096BCF44BF70CC85EFD37AAEF84328F044076F909AB252DE759905AB70

Function 00F65882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00F658C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00F658EE
DrawMenuBar.USER32(?), ref: 00F658FD

Strings

0, xrefs: 00F6588F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 1ed4e6f95135446b9d34585d96021c715dc9e12d08f243d5aa5e59f31359e5a0
Instruction ID: 8b6123fb96051a5560d028b6b3fcf54c30aac2bc564031782a99f8b569f68c1c
Opcode Fuzzy Hash: 1ed4e6f95135446b9d34585d96021c715dc9e12d08f243d5aa5e59f31359e5a0
Instruction Fuzzy Hash: B0016D32500258EFDB219F11DC44BAEBBB4FB45760F148099E889E6161DB709A84EF71

Function 00F2D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00F2D3BF
FreeLibrary.KERNEL32 ref: 00F2D3E5

Strings

X64, xrefs: 00F2D2A8
GetSystemWow64DirectoryW, xrefs: 00F2D3B9

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: c0a612ef2cd7a8c0ed98b32438e48860cbd89131db4c3808d94e95b1bb591760
Instruction ID: a5b8be9d8a9e9595c2e776bdaa97a2580738f12d0238c4fae080ff03dd924be9
Opcode Fuzzy Hash: c0a612ef2cd7a8c0ed98b32438e48860cbd89131db4c3808d94e95b1bb591760
Instruction Fuzzy Hash: 63F0AB32C06B79CBDB3152109C04BB93310AF12B24F698255F8D1F60C6D760CC40B2D2

Function 00F3007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb4df76fe7cf24666e2adca57bcde4faa175fd304abe40900b804ee6dac075b
Instruction ID: 83607331651af34ddc43aa45bdea48000cad540dcb4d78f2b0d0310d12caf3e3
Opcode Fuzzy Hash: eeb4df76fe7cf24666e2adca57bcde4faa175fd304abe40900b804ee6dac075b
Instruction Fuzzy Hash: 96C14A75A0020AEFDB14CF94C8A4BAEB7B5FF48724F108599E505EB251DB31DD41DB90

Function 00F5342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F53459
CoUninitialize.OLE32 ref: 00F53463
VariantInit.OLEAUT32(?), ref: 00F5346E
VariantClear.OLEAUT32(?), ref: 00F5371B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: fe886f9ec11def1d41d87af9e7627049b19cc39d06d7aa2c8bb414d8d3aa059f
Instruction ID: f353d9608745b38abbba5183fd1ba41fdbb1eecd78d899125026864d40c79780
Opcode Fuzzy Hash: fe886f9ec11def1d41d87af9e7627049b19cc39d06d7aa2c8bb414d8d3aa059f
Instruction Fuzzy Hash: 6CA13C756042019FC710DF28C485A2AB7E5FF88765F04895DFD89AB362DB30ED05DB92

Function 00F30436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00F6FC08,?), ref: 00F305F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00F6FC08,?), ref: 00F30608
CLSIDFromProgID.OLE32(?,?,00000000,00F6CC40,000000FF,?,00000000,00000800,00000000,?,00F6FC08,?), ref: 00F3062D
_memcmp.LIBVCRUNTIME ref: 00F3064E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 625a86e538e6dd9b9e84cebf1b1ca4e1447c45c737d00844876e8bcf02be4c5c
Instruction ID: a34429301b79f20d51985ae25d63fb009012de91575494630968a40cf917e7e6
Opcode Fuzzy Hash: 625a86e538e6dd9b9e84cebf1b1ca4e1447c45c737d00844876e8bcf02be4c5c
Instruction Fuzzy Hash: 72814971A00109EFCB04DF94C994EEEB7B9FF89325F204199F506AB250DB71AE06DB60

Function 00F5A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F5A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00F5A6BA

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00F5A79C
CloseHandle.KERNEL32(00000000), ref: 00F5A7AB

Part of subcall function 00EECE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00F13303,?), ref: 00EECE8A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 7240c4b69c04ebbd4f43267e97ba7072be007d7d58bff388f2ac139d014d377d
Instruction ID: f29f70bcc802036fa13ebbd92d43b55186f56b6ed013b806deb453a2fd620d6e
Opcode Fuzzy Hash: 7240c4b69c04ebbd4f43267e97ba7072be007d7d58bff388f2ac139d014d377d
Instruction Fuzzy Hash: D5517E715083009FD310EF24D886A6BBBE8FF89754F00591EF995A73A2EB70D905CB92

Function 00F11391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F114C0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5965ff45cdcc59869cd37bc239d17d2697ba0b5e95995c3e2f058cef70ba3aee
Instruction ID: 55579390c4a7eddfd70dcd80225ebe7ad4c179f5f3714fa5c4443b5e726b18e2
Opcode Fuzzy Hash: 5965ff45cdcc59869cd37bc239d17d2697ba0b5e95995c3e2f058cef70ba3aee
Instruction Fuzzy Hash: A1413C31A001046BEB25EFF99C456FE3AE5FF42B70F144225F619D61E2E67448817261

Function 00F66278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F662E2
ScreenToClient.USER32(?,?), ref: 00F66315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00F66382

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 8ab223cf92d189da12a3c8b6b960fbc389069203ff740c0a48285ca1eaa056ee
Instruction ID: 27e1d34969f8c7a9b32b9b5176fa3048c1b7f5b3ac218404330d1e0be089ab4c
Opcode Fuzzy Hash: 8ab223cf92d189da12a3c8b6b960fbc389069203ff740c0a48285ca1eaa056ee
Instruction Fuzzy Hash: 87511A74A00209AFDF10DF68D8819AE7BB5FB45364F10826AF865DB390D730AD81EB90

Function 00F51AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00F51AFD
WSAGetLastError.WSOCK32 ref: 00F51B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F51B8A
WSAGetLastError.WSOCK32 ref: 00F51B94

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 08e7ec120909e92120dd95d8b8e692f3e1a2e01f17638ec746f2d934e25fd263
Instruction ID: c3ffce09a7efde085f07059e4f68128cdfa73d0b70a3932be6756b2514ea7de9
Opcode Fuzzy Hash: 08e7ec120909e92120dd95d8b8e692f3e1a2e01f17638ec746f2d934e25fd263
Instruction Fuzzy Hash: D941C6346002006FD720AF24C886F2577E5EB84718F549449FA559F3D3D772ED42CB90

Function 00F0B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77036411ffc81d9af677faf6efc7d494bb7c6843010f150263c173b47c41cfa
Instruction ID: 6532b74804febcfb170ce0a3526d662562d68a2ac7496fc22b79756c8f41e581
Opcode Fuzzy Hash: c77036411ffc81d9af677faf6efc7d494bb7c6843010f150263c173b47c41cfa
Instruction Fuzzy Hash: 72412B76A00304AFD724DF78CC41BAABBE9EF88720F10466AF541DB2D1D3759A41A790

Function 00F456D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F45783
GetLastError.KERNEL32(?,00000000), ref: 00F457A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F457CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F457FA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 29ccab4c9ec5feb4980bc77bdff58a9e4838534bcc7af37880cb23665538d2cd
Instruction ID: 880a16e7d23d69143c1b48fe06319757000fde13ad256c9d1c1dd3a36b4e2927
Opcode Fuzzy Hash: 29ccab4c9ec5feb4980bc77bdff58a9e4838534bcc7af37880cb23665538d2cd
Instruction Fuzzy Hash: 3C414E35600611DFCB11EF15C444A5EBBF2EF89720B198489EC8AAB3A2DB34FD01DB91

Function 00F0D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00EF82D9,?,00EF82D9,?,00000001,?,?,00000001,00EF82D9,00EF82D9), ref: 00F0D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F0D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F0D9AB
__freea.LIBCMT ref: 00F0D9B4

Part of subcall function 00F03820: RtlAllocateHeap.NTDLL(00000000,?,00FA1444,?,00EEFDF5,?,?,00EDA976,00000010,00FA1440,00ED13FC,?,00ED13C6,?,00ED1129), ref: 00F03852

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 1b8ea2ab95a27dc6744cecb3556cc6714702540cbdabf8135bff738f301807e5
Instruction ID: 127c2aa172626f32ecd4811521fcfc8883a4e89c4a036d2845b038b4c5c7e540
Opcode Fuzzy Hash: 1b8ea2ab95a27dc6744cecb3556cc6714702540cbdabf8135bff738f301807e5
Instruction Fuzzy Hash: 8631CF72A0120AABDF24DFA4DC41EBE7BA5EB41720F054168FC14D7290EB35CD50EBA0

Function 00F652C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00F65352
GetWindowLongW.USER32(?,000000F0), ref: 00F65375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F65382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F653A8

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: c0759b303eb78fee9d966e085c4a55db8b7bd22df617b6b0dbbadfef24344a3d
Instruction ID: 2f6e2ea3937998085d28b217602280020e8da6cba3eafa2d733b143e0c62510a
Opcode Fuzzy Hash: c0759b303eb78fee9d966e085c4a55db8b7bd22df617b6b0dbbadfef24344a3d
Instruction Fuzzy Hash: 7331B235E55A0CAFEB309E54CC17BE93767AB05FA0F584102FA51A63E1C7B19940BB41

Function 00F3AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F3ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F3AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F3AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F3ACC6

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 6f36e699a7e97e8f7b1797c02ed17e419f024c23406ddfe32cc6bb2b43c9cbee
Instruction ID: 7519de0f15c5aadfdf3754af8afdf3dc18b3cf3c3114fc98275df964f95b19b5
Opcode Fuzzy Hash: 6f36e699a7e97e8f7b1797c02ed17e419f024c23406ddfe32cc6bb2b43c9cbee
Instruction Fuzzy Hash: B2311631E04618AFEB258B66CC087FE7BA5AB45370F08621AE4D5521D1C3B9CD81A792

Function 00F67674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00F6769A
GetWindowRect.USER32(?,?), ref: 00F67710
PtInRect.USER32(?,?,00F68B89), ref: 00F67720
MessageBeep.USER32(00000000), ref: 00F6778C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 591907b7fa9b080304c9a6ce455cffaa00d5e7314641c00fb8057650e4181bca
Instruction ID: 9572cc73d35879157d37b2f61e2599cd3a67e253bdb1ba22c34d59c94ccac70b
Opcode Fuzzy Hash: 591907b7fa9b080304c9a6ce455cffaa00d5e7314641c00fb8057650e4181bca
Instruction Fuzzy Hash: 4C41AE74A05318DFDB01EF58C894EA9BBF4FF49318F1980A8E4549B261D731E941EF90

Function 00F616DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00F616EB

Part of subcall function 00F33A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F33A57
Part of subcall function 00F33A3D: GetCurrentThreadId.KERNEL32 ref: 00F33A5E
Part of subcall function 00F33A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F325B3), ref: 00F33A65

GetCaretPos.USER32(?), ref: 00F616FF
ClientToScreen.USER32(00000000,?), ref: 00F6174C
GetForegroundWindow.USER32 ref: 00F61752

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 5b4e1605f73033b24b88e4e0355e6a54051fa5f7ee13e9e9416359c7bfe16b2d
Instruction ID: 8a4879d2c02a12d349b2488ceb852476078c6d98fa00bc7a77487bdb89c9d901
Opcode Fuzzy Hash: 5b4e1605f73033b24b88e4e0355e6a54051fa5f7ee13e9e9416359c7bfe16b2d
Instruction Fuzzy Hash: 80314175D00149AFCB00DFA9C881CAEBBF9FF48314B5480AAE455E7311E7359E45DBA0

Function 00F3DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00ED7620: _wcslen.LIBCMT ref: 00ED7625

_wcslen.LIBCMT ref: 00F3DFCB
_wcslen.LIBCMT ref: 00F3DFE2
_wcslen.LIBCMT ref: 00F3E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00F3E018

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: ca6d11e1100d788601707cdbf3f10de9ec5944325fd84dfe39f2ead345a27679
Instruction ID: 79b5562b2efd914bef37c5017cab3219d99e316f01f8b6814bc94b25029af30c
Opcode Fuzzy Hash: ca6d11e1100d788601707cdbf3f10de9ec5944325fd84dfe39f2ead345a27679
Instruction Fuzzy Hash: 7A2183B1D00218EFCB109FA8D981B7EBBF8EF85760F144065E905BB285D6B09E419BA1

Function 00F68FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

GetCursorPos.USER32(?), ref: 00F69001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F27711,?,?,?,?,?), ref: 00F69016
GetCursorPos.USER32(?), ref: 00F6905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F27711,?,?,?), ref: 00F69094

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 681eae63e107b23aac96ca783912ed597626e5ff35764e578e007fa4b0608b33
Instruction ID: 9de0182905097d6c07944be93588aaf888712c29bdda171b0f10073b039f6054
Opcode Fuzzy Hash: 681eae63e107b23aac96ca783912ed597626e5ff35764e578e007fa4b0608b33
Instruction Fuzzy Hash: B5218D35A05018BFDF258FA4CC58EFA7BB9FB8A360F144059F9455B261C3B19D50EBA0

Function 00F3D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00F6CB68), ref: 00F3D2FB
GetLastError.KERNEL32 ref: 00F3D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F3D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00F6CB68), ref: 00F3D376

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: f7bbabea9ed49a33cae4feca6eaa5fbae0c59ca194f2441a601d2bcb1f690aa8
Instruction ID: d19d7f0f28f4eafb17b2b69428e3e4e08c6cb7f884d8aee34083ca7861092254
Opcode Fuzzy Hash: f7bbabea9ed49a33cae4feca6eaa5fbae0c59ca194f2441a601d2bcb1f690aa8
Instruction Fuzzy Hash: EF21A170909201DF8300DF28E88196A77E4EE56778F104A1EF4E9D72A1D731DD4AEB93

Function 00F31571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F31014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F3102A
Part of subcall function 00F31014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F31036
Part of subcall function 00F31014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F31045
Part of subcall function 00F31014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F3104C
Part of subcall function 00F31014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F31062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F315BE
_memcmp.LIBVCRUNTIME ref: 00F315E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F31617
HeapFree.KERNEL32(00000000), ref: 00F3161E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 628f586d9b7bf64c0819d2b18ad7fc94a3131ad687ec71891962ca55e89181d5
Instruction ID: ebd022b60999c038c9023e7c8d7846bf924b24be48a1f53f6e86601fa8250c80
Opcode Fuzzy Hash: 628f586d9b7bf64c0819d2b18ad7fc94a3131ad687ec71891962ca55e89181d5
Instruction Fuzzy Hash: 0E21AC71E00109EFEF10DFA5C945BEEB7B8FF44364F098469E451AB241E770AA05EBA0

Function 00F62782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00F6280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F62824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F62832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00F62840

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 1338c9346d10490f78dd36443f5a0c4309b7c9b77fdb3b89888eda4b48469a70
Instruction ID: 016c3b0784d3a3a4ab5b8cd5263cf5059f942e131c3fe5ad76d1ef1536b96e27
Opcode Fuzzy Hash: 1338c9346d10490f78dd36443f5a0c4309b7c9b77fdb3b89888eda4b48469a70
Instruction Fuzzy Hash: 51212F31304911AFD7109B24CC40FAA7B99EF85324F188209F4668B2E2CBB5FC82DBD0

Function 00F378F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F38D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00F3790A,?,000000FF,?,00F38754,00000000,?,0000001C,?,?), ref: 00F38D8C
Part of subcall function 00F38D7D: lstrcpyW.KERNEL32(00000000,?,?,00F3790A,?,000000FF,?,00F38754,00000000,?,0000001C,?,?,00000000), ref: 00F38DB2
Part of subcall function 00F38D7D: lstrcmpiW.KERNEL32(00000000,?,00F3790A,?,000000FF,?,00F38754,00000000,?,0000001C,?,?), ref: 00F38DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00F38754,00000000,?,0000001C,?,?,00000000), ref: 00F37923
lstrcpyW.KERNEL32(00000000,?,?,00F38754,00000000,?,0000001C,?,?,00000000), ref: 00F37949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00F38754,00000000,?,0000001C,?,?,00000000), ref: 00F37984

Strings

cdecl, xrefs: 00F3797B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 44a29ba0e505fc4d88538f1d0cfe6de6d5d95e79965169b076ac86b574c8745d
Instruction ID: c24e5010a25305de82bc63d548ba7a39293282a77bf0287d821b274049c889db
Opcode Fuzzy Hash: 44a29ba0e505fc4d88538f1d0cfe6de6d5d95e79965169b076ac86b574c8745d
Instruction Fuzzy Hash: 9511067A201345ABCB256F35CC45E7A77A5FF853B0F00412AF842C7264EB71D801E791

Function 00F67CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00F67D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00F67D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F67D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00F4B7AD,00000000), ref: 00F67D6B

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 3173240902ab515836262bfc9ab41bfb0937e44dfe1825a633df67e6f0024962
Instruction ID: e4415f5f91a3d57773f480b8a5198c3a52065d77b72cc0f3ecbf053a99a56c59
Opcode Fuzzy Hash: 3173240902ab515836262bfc9ab41bfb0937e44dfe1825a633df67e6f0024962
Instruction Fuzzy Hash: D7115E72605619AFCB10AF28CC04A7A3BA5BF46374F154B24F879D72F0E7319951EB90

Function 00F65660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00F656BB
_wcslen.LIBCMT ref: 00F656CD
_wcslen.LIBCMT ref: 00F656D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F65816

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 20df5a6043854493ee1367fb7f9684b287125c50ca228cffe647b165459b7f4b
Instruction ID: e0628a10ca14a27cc72d682989c7b5ed653b24c3c020e77d0f77fe27d87e4b88
Opcode Fuzzy Hash: 20df5a6043854493ee1367fb7f9684b287125c50ca228cffe647b165459b7f4b
Instruction Fuzzy Hash: 9811B471A0060996DF20DF61CC85AFE77ACAF11B74F10406AF955F6082EBB4C980EB60

Function 00F01D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1733308cb98dccb1097e54311d42e7c2e51a41fa6264ed5af040661280dfb2
Instruction ID: cb2ca0020625855aa54121ae00dca34ef3c8588bf2628669944ece719af5ba4a
Opcode Fuzzy Hash: 7e1733308cb98dccb1097e54311d42e7c2e51a41fa6264ed5af040661280dfb2
Instruction Fuzzy Hash: 9A016DB260A61A7EF62127B86CC5F67762DEF427B8F340326F531A12D2EB649C047170

Function 00F31A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00F31A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F31A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F31A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F31A8A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b674bbe112543d6a98bded205fe269ae10c5333b117567075236b4a0f8a97117
Instruction ID: e2b4bd7eb29eeb71680376f794a5978ff65cbe2d2049a7dc7a561e2e52c5c28c
Opcode Fuzzy Hash: b674bbe112543d6a98bded205fe269ae10c5333b117567075236b4a0f8a97117
Instruction Fuzzy Hash: 3D11F73AD01219FFEF119BA5CD85FADBB78FB08760F200091EA14B7290D6716E50EB94

Function 00F3E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F3E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00F3E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F3E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F3E24D

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 9af9a68270703e00d5a58aa50a7f75e3849738303e00ef83269b042cc8573212
Instruction ID: 9c12ddee068123b1235de68fd51e44759b034c02e608beaf3438cdaba6acc7af
Opcode Fuzzy Hash: 9af9a68270703e00d5a58aa50a7f75e3849738303e00ef83269b042cc8573212
Instruction Fuzzy Hash: D61104B6D0425CBBDB019FA89C09AAF7FACAF46330F004215F964E32D0D2B0D900A7A0

Function 00EFD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00EFCFF9,00000000,00000004,00000000), ref: 00EFD218
GetLastError.KERNEL32 ref: 00EFD224
__dosmaperr.LIBCMT ref: 00EFD22B
ResumeThread.KERNEL32(00000000), ref: 00EFD249

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 5cc813da6cc267d7d7317af9fef0ff743aad299798f7b1d0a136a48b1c0a1910
Instruction ID: 02c4100922c42971865d3cc9123bcd3085f1d4edca5d29f6b3e3b8275335f002
Opcode Fuzzy Hash: 5cc813da6cc267d7d7317af9fef0ff743aad299798f7b1d0a136a48b1c0a1910
Instruction Fuzzy Hash: B301DB3650910CBBE7115BA5DC05BBF7E9ADF82331F105215FA25B21E0CB718901D6E0

Function 00F69EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00EE9BB2

GetClientRect.USER32(?,?), ref: 00F69F31
GetCursorPos.USER32(?), ref: 00F69F3B
ScreenToClient.USER32(?,?), ref: 00F69F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00F69F7A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 7b599caf9adc8d1db4ee08d3d74ac2c10033b7915514af112dbd7737fba42973
Instruction ID: 340729d16362021aff703e63f6448f5cf63715a4ba5bc35c3dbf4ff5b865114e
Opcode Fuzzy Hash: 7b599caf9adc8d1db4ee08d3d74ac2c10033b7915514af112dbd7737fba42973
Instruction Fuzzy Hash: 6E11483690411AABDB10DFA8CC499FE77BCFB05311F014455F962E3141D7B4BA81EBA1

Function 00ED600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00ED604C
GetStockObject.GDI32(00000011), ref: 00ED6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED606A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 600095cdf930954a8e57da12ba052d8b5b6f607f6ff0f31ab864e3fea1b7887d
Instruction ID: 2c7131fdcc20433d30bf440e69f54373c04a59fe6e2c353892bf1bf1d97f8f32
Opcode Fuzzy Hash: 600095cdf930954a8e57da12ba052d8b5b6f607f6ff0f31ab864e3fea1b7887d
Instruction Fuzzy Hash: 2811AD7210150CBFEF225FA4CC44EEABB69FF093A8F001202FA5466210C776DC61EBA0

Function 00EF3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00EF3B56

Part of subcall function 00EF3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00EF3AD2
Part of subcall function 00EF3AA3: ___AdjustPointer.LIBCMT ref: 00EF3AED

_UnwindNestedFrames.LIBCMT ref: 00EF3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00EF3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00EF3BA4

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: b4d89798be72d4b33f02a013059341ba02fc2df70206cf2492dfd09abd0b6504
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 6501297210014DBBDF125EA5CC42EFB7BA9EF88758F045015FF4866121C732E961EBA0

Function 00F03073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00ED13C6,00000000,00000000,?,00F0301A,00ED13C6,00000000,00000000,00000000,?,00F0328B,00000006,FlsSetValue), ref: 00F030A5
GetLastError.KERNEL32(?,00F0301A,00ED13C6,00000000,00000000,00000000,?,00F0328B,00000006,FlsSetValue,00F72290,FlsSetValue,00000000,00000364,?,00F02E46), ref: 00F030B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F0301A,00ED13C6,00000000,00000000,00000000,?,00F0328B,00000006,FlsSetValue,00F72290,FlsSetValue,00000000), ref: 00F030BF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: fd6413f21e5e28f81e67b4f4ebe5524d50110014773e5f9e0a14ffc417f96451
Instruction ID: 150ab9e2ba5fb1a3ade936383a705ba70144b0e2a80bc5a24b7a31ba018aeed5
Opcode Fuzzy Hash: fd6413f21e5e28f81e67b4f4ebe5524d50110014773e5f9e0a14ffc417f96451
Instruction Fuzzy Hash: D4012B33713226ABCB314B79AC44A677B9CAF06B75B104620FD59E31C0D721D901F6E0

Function 00F37464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00F3747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F37497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F374AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00F374CA

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 44a650b5da8abc976472f9f26556192b812afd6bdbb6d408396c289b2c2a6bf9
Instruction ID: faa8e883a6264cb4833f4e41ad60c48161bac0d928013f9eadb272075595b72c
Opcode Fuzzy Hash: 44a650b5da8abc976472f9f26556192b812afd6bdbb6d408396c289b2c2a6bf9
Instruction Fuzzy Hash: AC1170B1205314DBE730DF54EC08BA27BF8EB00710F108559E5A6D6191D7B0F904EB90

Function 00F3B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F3ACD3,?,00008000), ref: 00F3B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F3ACD3,?,00008000), ref: 00F3B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F3ACD3,?,00008000), ref: 00F3B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F3ACD3,?,00008000), ref: 00F3B126

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 19706de2f886352de7b2327d696e46cdaa0295ee699222bc2152f080bc355d38
Instruction ID: 257b5c98c15ae4e4bd3ebbdece64281e2ea13fb5c3be9bde4bacbb44b8ba95a9
Opcode Fuzzy Hash: 19706de2f886352de7b2327d696e46cdaa0295ee699222bc2152f080bc355d38
Instruction Fuzzy Hash: D3116171C0151CD7CF04AFE5D9687FEBB78FF0A721F104085DA91B6285CB705550ABA1

Function 00F67E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F67E33
ScreenToClient.USER32(?,?), ref: 00F67E4B
ScreenToClient.USER32(?,?), ref: 00F67E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F67E8A

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 8c32cc2034335a521d353ee0c076fd688c7766d32875b950207ecaddf01df14b
Instruction ID: bf3e7f9bb8b576d256036184f971cdf49ce69e4040ced0dff3dca54274a1e82e
Opcode Fuzzy Hash: 8c32cc2034335a521d353ee0c076fd688c7766d32875b950207ecaddf01df14b
Instruction Fuzzy Hash: D31163B9D0020AAFDB41DF98C8849EEBBF5FB08310F504056E965E3210D775AA54DF90

Function 00F32DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F32DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F32DD6
GetCurrentThreadId.KERNEL32 ref: 00F32DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F32DE4

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 028e1433ca8f0dd1ce4ef2bd6182715382ac691310eb1d62053174cac744a5e2
Instruction ID: bbcd079b4d947d5fc72d182bb7cc78103c58b050203f835a7b6844892c411422
Opcode Fuzzy Hash: 028e1433ca8f0dd1ce4ef2bd6182715382ac691310eb1d62053174cac744a5e2
Instruction Fuzzy Hash: 98E0ED725012287ADB202B63DC0DFFB7E6CEF56BB1F400115F59AD1090DAE68941E6F1

Function 00F68863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EE9693
Part of subcall function 00EE9639: SelectObject.GDI32(?,00000000), ref: 00EE96A2
Part of subcall function 00EE9639: BeginPath.GDI32(?), ref: 00EE96B9
Part of subcall function 00EE9639: SelectObject.GDI32(?,00000000), ref: 00EE96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00F68887
LineTo.GDI32(?,?,?), ref: 00F68894
EndPath.GDI32(?), ref: 00F688A4
StrokePath.GDI32(?), ref: 00F688B2

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b4c58f663cc131c72c7b283983814669e6fa3a54b784feb29ab158075ab14b38
Instruction ID: 753d4d63865b75a4e8886ea8523b244814e270721e6f86cf724c672abc604f79
Opcode Fuzzy Hash: b4c58f663cc131c72c7b283983814669e6fa3a54b784feb29ab158075ab14b38
Instruction Fuzzy Hash: 5AF05E3604125DFADB126F94AC09FDE3F69AF0A350F048100FAA1A50E2C7B55511EFE5

Function 00EE98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00EE98CC
SetTextColor.GDI32(?,?), ref: 00EE98D6
SetBkMode.GDI32(?,00000001), ref: 00EE98E9
GetStockObject.GDI32(00000005), ref: 00EE98F1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: a0c773efc367da23e869f827ac0bcf9be21d7b3483bb9c9ae677e16cd1ba8eea
Instruction ID: 6d8bb07044a81749efeb7e1776f41c10dd869281b99284ea032863f8ba85f941
Opcode Fuzzy Hash: a0c773efc367da23e869f827ac0bcf9be21d7b3483bb9c9ae677e16cd1ba8eea
Instruction Fuzzy Hash: 64E09B31644388AFDB216B74FC09BF93F50EB12735F048219F6FA540E5C3B14650AB51

Function 00F3162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00F31634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F311D9), ref: 00F3163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F311D9), ref: 00F31648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F311D9), ref: 00F3164F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: d8740ccb2fa93abe1a1f868fff398525e60c0f9340e8bc77f4688815a376111a
Instruction ID: 518b0b7718cc744ca125535af8da311726bef37bb1e5db00ce5fc939bfb42b02
Opcode Fuzzy Hash: d8740ccb2fa93abe1a1f868fff398525e60c0f9340e8bc77f4688815a376111a
Instruction Fuzzy Hash: 9EE08631A01215EBD7201FE19D0EB663B7CBF447A1F144808F6D5C9080D6B44440E790

Function 00F2D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F2D858
GetDC.USER32(00000000), ref: 00F2D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F2D882
ReleaseDC.USER32(?), ref: 00F2D8A3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 03c22deacb223a20c370d76286b4ff9f5613f86a75b58826bdd9139a7923158c
Instruction ID: da55104211cc381161d9fab577246f1e694fbb893eb319a2bd8fe1644a26437f
Opcode Fuzzy Hash: 03c22deacb223a20c370d76286b4ff9f5613f86a75b58826bdd9139a7923158c
Instruction Fuzzy Hash: E6E01AB5800209EFCB419FA0D8086BDBBF2FB08310F24A009E89AE7250C7B95901BF84

Function 00F2D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F2D86C
GetDC.USER32(00000000), ref: 00F2D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F2D882
ReleaseDC.USER32(?), ref: 00F2D8A3

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 9fb88d8c890c4f7ae716a9a6221e71bbca227090fcba4b542ce3d95fd582ad13
Instruction ID: 084d957cd98397c5d132c1e9259698649e77f15d45c15c08e1c9f77a589c25fa
Opcode Fuzzy Hash: 9fb88d8c890c4f7ae716a9a6221e71bbca227090fcba4b542ce3d95fd582ad13
Instruction Fuzzy Hash: 55E01A70800208EFCB409FA0D80866DBBF1FB08310B14A009E89AE7250C7B95901AF84

Function 00F44D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7620: _wcslen.LIBCMT ref: 00ED7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00F44ED4

Strings

*, xrefs: 00F44E10
LPT, xrefs: 00F44DFB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: cc6f664339e8b037bfa1c42eefb7edece79de7b642304f86131c32aefc301d57
Instruction ID: 5a92a76d425179ad8a847b77d191ce25666496fdb103bf51332357d13cf56674
Opcode Fuzzy Hash: cc6f664339e8b037bfa1c42eefb7edece79de7b642304f86131c32aefc301d57
Instruction Fuzzy Hash: CA915E75A002049FDB14DF58C484FA9BBF1BF44324F198099E84AAF3A2D735ED86DB91

Function 00EFE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00EFE30D

Strings

pow, xrefs: 00EFE2E5, 00EFE302

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 787d8ffbe580980e772599e62fa0c57ea702bccf736d4390a322700f34f18d31
Instruction ID: 0382366f6276bfbda20166537b1e43f6e7c81a277355f1c8cfabc8b420c890a1
Opcode Fuzzy Hash: 787d8ffbe580980e772599e62fa0c57ea702bccf736d4390a322700f34f18d31
Instruction Fuzzy Hash: BF516A61E0E30A96DB157B14CD053BA3BA4AB40750F3099D8E1D5923F9EB34ACD1BA46

Function 00EEE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00EEE1B1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 1167aeb3f9231781d81172b7eef650688ff0ef38b936ff9eb05e56b50f466a81
Instruction ID: 6269e1c6ccf8c67db8aa7ff9e45e07418ad77a9eebce5771440c8f33da7a7d2f
Opcode Fuzzy Hash: 1167aeb3f9231781d81172b7eef650688ff0ef38b936ff9eb05e56b50f466a81
Instruction Fuzzy Hash: 5C513435A0029ADFDB15DF68D4816FA7BA8EF19320F245055ECA1AB3D0D6349D42EBA0

Function 00EEF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00EEF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00EEF2BB

Strings

@, xrefs: 00EEF2AF

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 00db846c2d67d50c026b7a32dd13faa019609ef602f74117b0ca05ce22f5d28f
Instruction ID: 189f0884c758619b4ac76f696e34ae48bdb4d5402b45ea6657ce8eb05560d3ed
Opcode Fuzzy Hash: 00db846c2d67d50c026b7a32dd13faa019609ef602f74117b0ca05ce22f5d28f
Instruction Fuzzy Hash: C55158715087499BD320AF10DC86BAFBBF8FB84340F91884DF1D9911A5EB70852ACB66

Function 00F55745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00F557E0
_wcslen.LIBCMT ref: 00F557EC

Strings

CALLARGARRAY, xrefs: 00F557E6, 00F557EB

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: ee1de5ca8dd5f9078b694159dc85343020b421f4eee54f3c692a4d59b05c39d6
Instruction ID: b75fd6a3b31cdf76b6472c7b43431231df0e78d73e4f903eb8b78198872a1d3f
Opcode Fuzzy Hash: ee1de5ca8dd5f9078b694159dc85343020b421f4eee54f3c692a4d59b05c39d6
Instruction Fuzzy Hash: CB41F231E002099FCB04DFA8C8919BEBBF5FF59722F104029E905A7291E7319D85DB90

Function 00F4D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F4D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F4D13A

Strings

|, xrefs: 00F4D10B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: e2a09c1bf739855d5df34bfac90036249b148b33314974009fb8f8be261e7d6f
Instruction ID: a42f90ae67bc5e80054647c7bb7958f9e2b8d7b2298a01b959c17a906d468009
Opcode Fuzzy Hash: e2a09c1bf739855d5df34bfac90036249b148b33314974009fb8f8be261e7d6f
Instruction Fuzzy Hash: D0311875D00209ABDF15EFA4CC85AEEBFB9FF44310F10001AED15B6262E731AA46DB60

Function 00F6356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00F63621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F6365C

Strings

static, xrefs: 00F635BC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 6804971138216b8911b298b0fb916a7016834a4f5d1f5fe31fb9866df4291903
Instruction ID: 5579cedf719354853fb1ccbb0afab944e6a17038413096d8195c6b38817458bb
Opcode Fuzzy Hash: 6804971138216b8911b298b0fb916a7016834a4f5d1f5fe31fb9866df4291903
Instruction Fuzzy Hash: 7231B071500204AEDB109F68CC40EFB73A9FF88764F009619F8A5D7280DA71AD81E760

Function 00F64537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00F6461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F64634

Strings

', xrefs: 00F6458E

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 06ca63f4857d793cda7f2e9d84737e12928c222d6b0b126251c06d1f7e73afe1
Instruction ID: c3fef1b786fbd5a8802a01b04b4c8323fa635eb7ce5f5ff1a4b0c9d7bdf061c4
Opcode Fuzzy Hash: 06ca63f4857d793cda7f2e9d84737e12928c222d6b0b126251c06d1f7e73afe1
Instruction Fuzzy Hash: 20313975A0130A9FDF14DFA9C980BDABBB5FF09300F14406AE905AB381D771A941DF90

Function 00F631EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F6327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F63287

Strings

Combobox, xrefs: 00F63249

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 1f45bfb5440aea4aac08b880fbf620f666bd94c4928a8942f2c8168ad0d310c3
Instruction ID: 591e5e3d673b967d25895859f7ce6761a36356202061585de1a75ab67f9db4a9
Opcode Fuzzy Hash: 1f45bfb5440aea4aac08b880fbf620f666bd94c4928a8942f2c8168ad0d310c3
Instruction Fuzzy Hash: 8711B2717002087FFF219E54DC90EBB37AAEB953A4F104129F92897291D6719D51A760

Function 00F63710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00ED600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00ED604C
Part of subcall function 00ED600E: GetStockObject.GDI32(00000011), ref: 00ED6060
Part of subcall function 00ED600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED606A

GetWindowRect.USER32(00000000,?), ref: 00F6377A
GetSysColor.USER32(00000012), ref: 00F63794

Strings

static, xrefs: 00F63757

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 30a7a87b8ed49e5d92c69257272c28d4b9f6291d72bb0ecd7c0cc65a98304c11
Instruction ID: 5caff26a820c2c57838e4690c73a2fbbab5c62f23f1ead7a3b6801a6deb38cbf
Opcode Fuzzy Hash: 30a7a87b8ed49e5d92c69257272c28d4b9f6291d72bb0ecd7c0cc65a98304c11
Instruction Fuzzy Hash: BC1129B2610209AFDF10DFA8CC45AFA7BB8FB09354F004515F9A6E3250D775E851AB50

Function 00F4CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F4CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F4CDA6

Strings

<local>, xrefs: 00F4CD66

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: ab77458902b57b001d57f39700abce466315a265194993c2cdb52d43991235c4
Instruction ID: 3f1abc5b13475eecb55c37723f0191d8e7a81b4cfd36b5bb9ba04dd246fbc8c9
Opcode Fuzzy Hash: ab77458902b57b001d57f39700abce466315a265194993c2cdb52d43991235c4
Instruction Fuzzy Hash: 0311A372A066367AD7684A668C45FF7BE78EF127B4F005226F96983190D6609840E6F0

Function 00F63429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00F634AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F634BA

Strings

edit, xrefs: 00F6348F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 3eb6f75a2fbae9c6582bf8769b7c927d50a70f71156421246209c17dbad30550
Instruction ID: 97913c2ad28c07756ab3d63577ff08ab759b5ea1021850663162cf3b28c7c234
Opcode Fuzzy Hash: 3eb6f75a2fbae9c6582bf8769b7c927d50a70f71156421246209c17dbad30550
Instruction Fuzzy Hash: 48118F71500108ABEF218E64DC44AFB776AEF05374F504324F9A5931E4CB75DC51B750

Function 00F36C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00F36CB6
_wcslen.LIBCMT ref: 00F36CC2

Strings

STOP, xrefs: 00F36CBC, 00F36CC1

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: a90aa89917be69db64b2159f18390fdbabd8137b143a5cf3da1c904f321b65fa
Instruction ID: f16438605d1f60b1fc597288d2718b5459e2801538a61ef191bf97889375f4fc
Opcode Fuzzy Hash: a90aa89917be69db64b2159f18390fdbabd8137b143a5cf3da1c904f321b65fa
Instruction Fuzzy Hash: 6D010432A00527AACB209FBDDC809BF73F4EA60775B105529E862E6291EA31D900E750

Function 00F31CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F31D4C

Strings

ComboBox, xrefs: 00F31CEB
ListBox, xrefs: 00F31D16

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: dc724770bb8fdc41f9ea939748bda53a65244a973c6dd89b2ef0decc3cc7dc82
Instruction ID: f9dc1818514cb1a922da7123e63a0c897b676c556b37ecbc52bf2c50d13b4323
Opcode Fuzzy Hash: dc724770bb8fdc41f9ea939748bda53a65244a973c6dd89b2ef0decc3cc7dc82
Instruction Fuzzy Hash: 09012835A00218AB8B08EFA0DC11DFE73A8FB47770F10051AF872673C2EA345909A760

Function 00F31BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00F31C46

Strings

ComboBox, xrefs: 00F31BE5
ListBox, xrefs: 00F31C10

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a9a6336f6f4d26dd969458772bc3c17bccbe231b6c73d306f85a97fd27747c68
Instruction ID: 52fe16eba1c9237cb4454cea6e70198b50993fed246cbd30c9aeebae731da666
Opcode Fuzzy Hash: a9a6336f6f4d26dd969458772bc3c17bccbe231b6c73d306f85a97fd27747c68
Instruction Fuzzy Hash: AA01F775B8010866DF08EBA0DD51EFF73E8EB11790F10201AB41677282EA249E08A7B1

Function 00F31C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00F31CC8

Strings

ComboBox, xrefs: 00F31C69
ListBox, xrefs: 00F31C94

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 3d63217daddb160582d0d29ecc04f4bb418e7db4cfe1c8a9226b2e5008fede8f
Instruction ID: 8bbb8936d284a67252018bc3d5e8aab8606b171a14e6d3fe2140daf42690fdff
Opcode Fuzzy Hash: 3d63217daddb160582d0d29ecc04f4bb418e7db4cfe1c8a9226b2e5008fede8f
Instruction Fuzzy Hash: AC01D675B8011867DF04EBA0DE01AFE73E8AB117A0F142016B80277282EA659F09E672

Function 00F31D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9CB3: _wcslen.LIBCMT ref: 00ED9CBD

Part of subcall function 00F33CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F33CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00F31DD3

Strings

ComboBox, xrefs: 00F31D75
ListBox, xrefs: 00F31DA0

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e8fa0e6be12b7d5adb5b9490383763c575460753041e715de913f69f23754f50
Instruction ID: 02d25f0bb657355a48738458dec04417388d2232821a4e83840dece1fc4d202b
Opcode Fuzzy Hash: e8fa0e6be12b7d5adb5b9490383763c575460753041e715de913f69f23754f50
Instruction Fuzzy Hash: FAF0F471B4021866DB08EBA4DC52BFE73A8FF02760F041916B822772C2DA649909A260

Function 00F5747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F57493
_wcslen.LIBCMT ref: 00F574B9

Strings

3, 3, 16, 1, xrefs: 00F57483

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: ac11f7f2ad6d827c1db1cf6dddd1ca9b9e01db423ecc71341e4d35365f6b856f
Instruction ID: 575632957d4453d70f87d8caf99a93ce1838632a3edd93a333bb5e547d634240
Opcode Fuzzy Hash: ac11f7f2ad6d827c1db1cf6dddd1ca9b9e01db423ecc71341e4d35365f6b856f
Instruction Fuzzy Hash: EEE02B427143215093313279BCC197F56C9CFC5761714282FFF85D22A7EAD4CD91A3A1

Function 00F30B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F30B23

Strings

AutoIt, xrefs: 00F30B17
Error allocating memory., xrefs: 00F30B1C

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 2880d0273881b292aa50ce7289766442b6819d370c8c37dbae60659f7f37d44a
Instruction ID: 38bbc2275cdd1ce0cf9bb7c8691e91b57187c527f5a336008385294c524a8ccf
Opcode Fuzzy Hash: 2880d0273881b292aa50ce7289766442b6819d370c8c37dbae60659f7f37d44a
Instruction Fuzzy Hash: E8E04F3228435C2AE31436957C03F997AC48F05F61F10542BFBD8B95D38AE2649066EA

Function 00EF0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EEF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00EF0D71,?,?,?,00ED100A), ref: 00EEF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00ED100A), ref: 00EF0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00ED100A), ref: 00EF0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00EF0D7F

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: b828bb3b118cc903a76fd7136b8f7cd650d9516c85a1d6fc85fefb85cfdb9f0e
Instruction ID: 669d86f78487af3565a45ff5803df9d488f9a2a38766e2b2f00c4eb727760c68
Opcode Fuzzy Hash: b828bb3b118cc903a76fd7136b8f7cd650d9516c85a1d6fc85fefb85cfdb9f0e
Instruction Fuzzy Hash: C6E092742003558BD7309FB8E4043667BE4BF14744F00992EE9D2D6652EBF2E4489BD1

Function 00F43017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00F4302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00F43044

Strings

aut, xrefs: 00F43038

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 86b8dc6ad7cb6c813ecd4ee97c67efbee32b6d1a97377c1b5b21e73984d1be55
Instruction ID: 8c0f6c59b27a38b6857a4976f48fb7c6253bd957186eda794774c65eed905b0e
Opcode Fuzzy Hash: 86b8dc6ad7cb6c813ecd4ee97c67efbee32b6d1a97377c1b5b21e73984d1be55
Instruction Fuzzy Hash: D0D05E7250032867DA20A7A4EC0EFDB3A6CDB04750F0002A2BAE5E2091DAF4D984CBD0

Function 00F2D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F2D220

Strings

X64, xrefs: 00F2D2A8
%.3d, xrefs: 00F2D22B

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 5af3cd1b522b04f9935f0a248b69c4a8d8c30f2b994707090240df7f1c5a79a1
Instruction ID: d5827ce1fd693e56ea64407c8a1642fd429fae12aa651896164b69818075cc7d
Opcode Fuzzy Hash: 5af3cd1b522b04f9935f0a248b69c4a8d8c30f2b994707090240df7f1c5a79a1
Instruction Fuzzy Hash: 36D0126280822CEADB5097E0EC45AF9B3BCEB08301F608452F906A1080D624C508B762

Function 00F62356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F6236C
PostMessageW.USER32(00000000), ref: 00F62373

Part of subcall function 00F3E97B: Sleep.KERNEL32 ref: 00F3E9F3

Strings

Shell_TrayWnd, xrefs: 00F62365

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 06c682279bee2a31eeb99bd807de1908d1a2b332e1bb7f5a38c59682ece00442
Instruction ID: fb179d2dcb390e7df1b279130ae80bcb3a1f30c7eb75029f1b4b27df5c76e651
Opcode Fuzzy Hash: 06c682279bee2a31eeb99bd807de1908d1a2b332e1bb7f5a38c59682ece00442
Instruction Fuzzy Hash: 07D0C9323813147AEA64B770EC0FFDA7A149B04B10F004916B696EA1D1C9E4A8019A99

Function 00F62322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F6232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00F6233F

Part of subcall function 00F3E97B: Sleep.KERNEL32 ref: 00F3E9F3

Strings

Shell_TrayWnd, xrefs: 00F62325

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 23a6aad272b419a98aaa1ae368bca219f26531a1725e21c2a0f7010067176bf1
Instruction ID: cc724ccde0613c87c7895aba91c6faef9d2fb55962e00c25d175484d3c5fe8b9
Opcode Fuzzy Hash: 23a6aad272b419a98aaa1ae368bca219f26531a1725e21c2a0f7010067176bf1
Instruction Fuzzy Hash: 1AD01236395314B7EA64B770EC0FFDA7A149F04B10F004916B7DAEA1D1C9F4A801DB94

Function 00F0BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00F0BE93
GetLastError.KERNEL32 ref: 00F0BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F0BEFC

Memory Dump Source

Source File: 00000000.00000002.1810124101.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1810088574.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F6C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810283192.0000000000F92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810899461.0000000000F9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811376559.0000000000FA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 6b7460cd915e54e28d148c72b00877568e0b0531a7b8222acd0cb4aeda81faf7
Instruction ID: c3d5af6f098458e9a9a09b72521cc757c4e8ae07045740ade7d523dd13c47b53
Opcode Fuzzy Hash: 6b7460cd915e54e28d148c72b00877568e0b0531a7b8222acd0cb4aeda81faf7
Instruction Fuzzy Hash: CC41D635A05207AFDF218FA4CC44BBA7BA9EF42721F144169FA599B1E1DB708D01FB60

Analysis Process: firefox.exePID: 7564, Parent PID: 7812COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000023F47DE7D77 Relevance: 8.4, APIs: 1, Instructions: 6852nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0000023F47DE7D9C

Memory Dump Source

Source File: 00000010.00000002.3016590298.0000023F47DE5000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000023F47DE5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_23f47de5000_firefox.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: a3d4a310f25344abd1978f5247c9d082b9ccbb3eaa73dfa71153365510a96fee
Instruction ID: 2c671a421a1f6f6a3e2031d59c3c45021db7b7450d299656d1949ec6d98ecc5f
Opcode Fuzzy Hash: a3d4a310f25344abd1978f5247c9d082b9ccbb3eaa73dfa71153365510a96fee
Instruction Fuzzy Hash: 55A3D831624E498BDB6EDF28DC856AA77F5FB55300F04423EDA4BC3251DB34EA468B81

Function 0000023F47DD51C1 Relevance: .1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.3015853477.0000023F47DD5000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000023F47DD5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_23f47dd5000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6f4d9a3ca513e3ad49e0e639f16350e0c781913e8d57cec4755569d5834b64
Instruction ID: b5c182e455550a4d1308f040d46c528775b333d071bfe94238393255704b9341
Opcode Fuzzy Hash: ac6f4d9a3ca513e3ad49e0e639f16350e0c781913e8d57cec4755569d5834b64
Instruction Fuzzy Hash: 1A21723151CB8C4FD755DF28C844A56BBF0FB9A310F1506AFE09AC3292DA34D9498782

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 151.101.129.91 151.101.129.91
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 34.160.144.191 34.160.144.191

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000D.00000003.1967353040.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1968233073.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1961187933.000001A2FBA62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1881291801.000001A30A071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1956475110.000001A30984F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957523914.000001A307934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1956475110.000001A30984F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1883402470.000001A305FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957523914.000001A307934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1884160502.000001A305F13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990604345.000001A305F18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1881291801.000001A30A071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1956475110.000001A30984F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957523914.000001A307934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1956475110.000001A30984F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1883402470.000001A305FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1957523914.000001A307934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3017064904.0000023F47E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3017064904.0000023F47E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3017064904.0000023F47E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/nj` equals www.facebook.com (Facebook)
Source: firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/nj` equals www.twitter.com (Twitter)
Source: firefox.exe, 00000011.00000002.3016737730.0000024DE3F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/nj` equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1884160502.000001A305F13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1995273055.000001A2FFB6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1990604345.000001A305F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000D.00000003.1995273055.000001A2FFB6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000D.00000003.1889404825.000001A2FFDCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1991797721.000001A2FFDE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000D.00000003.1993939547.000001A2FFDE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49864 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_86eb8470-c60d-4f76-9c03-3ab2cebecb21.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_86eb8470-c60d-4f76-9c03-3ab2cebecb21.json.tmp

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre