Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1501794
MD5:	705d1a22a19751c0856355777c700e65
SHA1:	30ad91437d4a503d8711542270e779caedd68a9e
SHA256:	aa78a471bb738b74a22f5bbbc68fd2337f50912a35af13f96480ce007cec35ed
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2416 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 705D1A22A19751C0856355777C700E65)

msedge.exe (PID: 5312 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,13542706911432229970,12581857463732113695,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1404 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8588 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7112 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8676 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8968 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8412 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4780 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9828 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2052,i,8548949589357949916,9248762715934791281,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5956 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2052,i,18235629407557685321,15700958897455494623,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2024,i,16407138273607858583,5544686832840600377,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: protocols.json.3.dr, protocols.json.11.dr	String found in binary or memory: https://.onedrive.com
Source: protocols.json.3.dr, protocols.json.11.dr	String found in binary or memory: https://.onedrive.live.com
Source: file.exe, 00000000.00000002.2900351324.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2900351324.0000000000E58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: eec795e9-c888-42cd-92b5-fcb8ba7191a3.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: eec795e9-c888-42cd-92b5-fcb8ba7191a3.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2900100307.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: protocols.json.3.dr, protocols.json.11.dr	String found in binary or memory: https://sharepoint.com
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: eec795e9-c888-42cd-92b5-fcb8ba7191a3.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.3.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.3.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 58905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58907
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 58906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 58907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005DEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_005DEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005DED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_005DED6A

Source: C:\Users\user\Desktop\file.exe

0_2_005DEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005CAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_005CAA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_005F9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1637223692.0000000000622000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3edcfe6d-9
Source: file.exe, 00000000.00000000.1637223692.0000000000622000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e914f96a-7
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_dd2f71f7-2
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0df18bf4-8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005CD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_005CD5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_005C1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005CE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_005CE8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D2046	0_2_005D2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00568060	0_2_00568060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C8298	0_2_005C8298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059E4FF	0_2_0059E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059676B	0_2_0059676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F4873	0_2_005F4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056CAF0	0_2_0056CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058CAA0	0_2_0058CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057CC39	0_2_0057CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00596DD9	0_2_00596DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057B119	0_2_0057B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005691C0	0_2_005691C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00581394	0_2_00581394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00581706	0_2_00581706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058781B	0_2_0058781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057997D	0_2_0057997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00567920	0_2_00567920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005819B0	0_2_005819B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00587A4A	0_2_00587A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00581C77	0_2_00581C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00587CA7	0_2_00587CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EBE44	0_2_005EBE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00599EEE	0_2_00599EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056BF40	0_2_0056BF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00581F32	0_2_00581F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00580A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0057F9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/525@22/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D37B5 GetLastError,FormatMessageW,

0_2_005D37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C10BF AdjustTokenPrivileges,CloseHandle,		0_2_005C10BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_005C16C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005D51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005EA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_005EA67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_005D648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_005642A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\1614910e-0484-434d-b2c4-0845a88cba34.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.3.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,13542706911432229970,12581857463732113695,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7112 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4780 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2052,i,8548949589357949916,9248762715934791281,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2052,i,18235629407557685321,15700958897455494623,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2024,i,16407138273607858583,5544686832840600377,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,13542706911432229970,12581857463732113695,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7112 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4780 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2052,i,8548949589357949916,9248762715934791281,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2052,i,18235629407557685321,15700958897455494623,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2024,i,16407138273607858583,5544686832840600377,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005642DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00580A76 push ecx; ret

0_2_00580A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0057F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_005F1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-94861

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6579

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 1704

Thread sleep time: -65790s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6579 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005CDBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D68EE FindFirstFileW,FindClose,	0_2_005D68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005D698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005D9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005D5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005642DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95074

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005DEAA2 BlockInput,

0_2_005DEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00592622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00592622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005642DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00584CE8 mov eax, dword ptr fs:[00000030h]

0_2_00584CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_005C0B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00592622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00592622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0058083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005809D5 SetUnhandledExceptionFilter,	0_2_005809D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00580C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00580C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_005C1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005A2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_005A2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0057F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_0057F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_005E22DA

Source: C:\Users\user\Desktop\file.exe

0_2_005C0B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_005C1663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00580698 cpuid

0_2_00580698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_005D8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005BD27A GetUserNameW,

0_2_005BD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0059BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0059BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005642DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_005E1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_005E1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	21%	ReversingLabs
file.exe	22%	Virustotal	Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://.onedrive.live.com	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://.onedrive.live.com	1%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://.onedrive.com	0%	Avira URL Cloud	safe
https://msn.com	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://drive.google.com/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://sharepoint.com	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://sharepoint.com	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://.onedrive.com	0%	Virustotal		Browse
https://www.office.com/Office	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.185.225	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.3.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.3.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://.onedrive.live.com	protocols.json.3.dr, protocols.json.11.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.3.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.3.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.3.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://.onedrive.com	protocols.json.3.dr, protocols.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.3.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	eec795e9-c888-42cd-92b5-fcb8ba7191a3.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sharepoint.com	protocols.json.3.dr, protocols.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2900100307.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.55.235.170	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.81.238	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.65.174	unknown	United States	15169	GOOGLEUS	false
142.250.65.196	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501794
Start date and time:	2024-08-30 14:07:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/525@22/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 312
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 64.233.184.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.181.227, 142.250.186.67, 2.23.209.160, 2.23.209.150, 2.23.209.158, 2.23.209.154, 2.23.209.156, 2.23.209.155, 2.23.209.167, 2.23.209.157, 2.23.209.166, 20.223.35.26, 142.250.184.206, 199.232.210.172, 192.229.221.95, 142.250.186.170, 216.58.212.138, 142.250.181.234, 142.250.185.234, 142.250.186.106, 142.250.185.74, 142.250.185.138, 142.250.186.74, 172.217.16.138, 142.250.74.202, 142.250.185.170, 142.250.185.202, 172.217.23.106, 142.250.184.234, 142.250.185.106, 216.58.212.170, 142.251.40.227, 142.251.41.3, 142.251.35.163, 142.250.65.195, 142.251.40.163, 142.251.32.99, 142.250.80.67
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.az
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:07:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:08:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:08:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:08:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.55.235.170	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	lmiXXjKzpz.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.19912.30037.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.21247.5426.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	https://t.dripemail2.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzA4MjQ4MzIzLCJuYmYiOjE3MDgyNDgzMjMsImFjY291bnRfaWQiOiI1Mzg0NjQ5IiwiZGVsaXZlcnlfaWQiOiJhcXZsbHdxNXNvOHpkM3I5MWE4YSIsInVybCI6Imh0dHBzOi8vd3d3LnBpZ2VvbmZvcmdldG5ndWlkZS5jb20vbG9kZ2luZy9jYWJpbnMvP3V0bV9zb3VyY2U9ZW1haWxfbWFya2V0aW5nJnV0bV9tZWRpdW09SW5zaWRlclRyYXZlbEdyb3VwJnV0bV9jYW1wYWlnbj1OZXdzJTIwZnJvbSUyMFBpZ2VvbiUyMEZvcmdlLCUyMFROJnV0bV9jb250ZW50PTIvMTYvMjQlMjBCdWRnZXQlMjBUaXBzJTIwKHJlc2VuZCUyMHRvJTIwdW5vcGVuZWQpJl9fcz1wdHlwaW5yc2NneGJ1dzlidTNqdCJ9.ZR7oVrQj9RQ2DeO2Ih4e2hYiF1tbp_XQCM4Br0ytBhk	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://www.bettercaremarket.com.au/pill-bottle-opener-with-magnifier-aidapt.html?comet_source=google&comet_network=x&comet_campaign=20867905123&comet_ad_group=&comet_ad_id=&comet_keyword=&comet_type=smart&gad_source=1&gclid=EAIaIQobChMIqcj6sY-ZhwMV5tgWBR0YswpVEAQYASABEgJi9fD_BwE	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://1109b4f.wcomhost.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://l9sa.github.io/	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://uaj.sa/api/aHR0cHM6Ly9nb29nbGUuY29t&sig=ZDUxNjU0ZTllNzZkYTAxNWE4OTNkZTAyM2ZkZDA1MGViMGIzY2UyOTU1MzY1NGMyNjFlOTExM2ZiMzA5MzdmMg&exp=MTcyNDIzOTUzMQ	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
chrome.cloudflare-dns.com	https://www.pgregdoc.com/?lngSubscriptionID=1590&lngSubscriptionCountryID=333&lngCountryID=13&lngLanguageID=13&lngCategoryID=861&lngProductID=9939	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	http://hkwyolaw.ency.cloud	Get hash	malicious	HTMLPhisher	Browse	172.233.123.231
	file.exe	Get hash	malicious	Unknown	Browse	23.54.161.105
	IMG_2971111173.dll	Get hash	malicious	Unknown	Browse	172.233.110.37
	IMG_2971111173.dll	Get hash	malicious	Unknown	Browse	172.233.110.37
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	23.215.35.34
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
CLOUDFLARENETUS	https://www.pgregdoc.com/?lngSubscriptionID=1590&lngSubscriptionCountryID=333&lngCountryID=13&lngLanguageID=13&lngCategoryID=861&lngProductID=9939	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://my.manychat.com/r?act=b1d1d0d9200d3868d1853ccaa94cc1bd&u=7887682621342430&p=103103452689925&h=a38dde33b0&fbclid=IwZXh0bgNhZW0CMTAAAR255FXiu0i6VqiGosbKpjjRUX1BYHGeW223cElw8PWRqBIcw1p8KqCt2ts_aem_wcyA7fIGRg9jvwzVDUFgsQ	Get hash	malicious	Unknown	Browse	104.26.12.42
	https://piclut.com/n/?c3Y9bzM2NV8xX3NwJnJhbmQ9WlRaTlREUT0mdWlkPVVTRVIyOTA3MjAyNFUxODA3MjkwMA=	Get hash	malicious	Unknown	Browse	104.21.92.125
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://atleta.cc/p/nhIV/nhIVK2HJ8jDp/events/nhIVKqyT0qnH/2671fb552ce451a567e7dce11cef9680739b3b5a0c26f7529dcd75e01af50dd9	Get hash	malicious	Unknown	Browse	104.16.40.28
	SecuriteInfo.com.Trojan.DownLoader47.19820.5694.3811.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://hkwyolaw.ency.cloud	Get hash	malicious	HTMLPhisher	Browse	172.64.146.38
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://atleta.cc/p/nhIV/nhIVotMsZL1Y/events/nhIVKqyT0qnH/5f183c0daed7d496aa97744146b266cf9fa0638182530a016615a50747f5935c	Get hash	malicious	Unknown	Browse	104.16.40.28
	Feature Status Update 3RLSM.html	Get hash	malicious	Unknown	Browse	104.17.25.14
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://www.canva.com/design/DAGPPl56DNg/cYAT8vVgXFW1kGsDfr_y8g/view?utm_content=DAGPPl56DNg&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	150.171.28.10
	Y3Wvl9aYAU.cmd	Get hash	malicious	AteraAgent	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
	file.exe	Get hash	malicious	Unknown	Browse	20.96.153.111
	F.7z	Get hash	malicious	Unknown	Browse	20.71.50.126
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	20.169.237.51
	sora.mips.elf	Get hash	malicious	Mirai	Browse	72.152.158.255
EDGECASTUS	Feature Status Update 3RLSM.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	Y3Wvl9aYAU.cmd	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://1109b4f.wcomhost.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://l9sa.github.io/	Get hash	malicious	Unknown	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.bellantonicioccolato.it/wp-content/uploads/2020/11/gutweedtE.exe	Get hash	malicious	KoiLoader	Browse	13.85.23.86 184.28.90.27
	https://www.pgregdoc.com/?lngSubscriptionID=1590&lngSubscriptionCountryID=333&lngCountryID=13&lngLanguageID=13&lngCategoryID=861&lngProductID=9939	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://my.manychat.com/r?act=b1d1d0d9200d3868d1853ccaa94cc1bd&u=7887682621342430&p=103103452689925&h=a38dde33b0&fbclid=IwZXh0bgNhZW0CMTAAAR255FXiu0i6VqiGosbKpjjRUX1BYHGeW223cElw8PWRqBIcw1p8KqCt2ts_aem_wcyA7fIGRg9jvwzVDUFgsQ	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://piclut.com/n/?c3Y9bzM2NV8xX3NwJnJhbmQ9WlRaTlREUT0mdWlkPVVTRVIyOTA3MjAyNFUxODA3MjkwMA=	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://atleta.cc/p/nhIV/nhIVK2HJ8jDp/events/nhIVKqyT0qnH/2671fb552ce451a567e7dce11cef9680739b3b5a0c26f7529dcd75e01af50dd9	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://singular-catharanthus-5a60b5a247c5.herokuapp.com/b?y=49ii4eh26or68c1m61j38oph6sq38e9g69i32cpn6dim6e925gh748hq49k78t3gect2ubr7dhnm4obcdlgn6srke9gmssr9egn6spbk5tjmorr2c5m2qc9g60o2qtbgcdnmqqbecsmn4ob9dgmn0sjfd9im6t3j5lp6as3fe9q2qobecgmm8obkc5h62sr55kp30chj5kp2u8g=	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://hkwyolaw.ency.cloud	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://atleta.cc/p/nhIV/nhIVotMsZL1Y/events/nhIVKqyT0qnH/5f183c0daed7d496aa97744146b266cf9fa0638182530a016615a50747f5935c	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	5.490963123247034
Encrypted:	false
SSDEEP:	96:0q8NkGS1fipvhQ58rh/cI9URoDotoqHB0xuvyAFHJkXikcWSDS4S4SDS2AI4a:/8NBSEpvPeoDUDWaFpktx
MD5:	D5AA0A89697B769C85E038CC38ECB197
SHA1:	BA30452814FB03F58613EAFAA1252993C8560DDF
SHA-256:	9E5834FEFD01FDDDD5DEC393398BFB67ECF7AB8D3FF167947F57CC890A5898CD
SHA-512:	64D9180E1F6F76D9AD70576B14CD4A5B0B88E660441A0526C66E0B130139D1D08924FAE5EA153A46C67D7B7DA687F8F4F66A3CE5E7650F10EDAEB5CCE39E01C1
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/w

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1c5809d2-7e64-48cb-9006-57efa6c99ff7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71256
Entropy (8bit):	6.073890362759445
Encrypted:	false
SSDEEP:	1536:WMGQ5XMBGD73IBrU5gYY0fwEh1MV9ml408gpM1vdPwPdrBshUR:WMrJM8f3IJU5I0IEK9q8aYSPhBshy
MD5:	10CB84035843133A3451DAB9BADAD305
SHA1:	A9A45A49DA49F6BC63C1115B1FFFCDD6DCC9C2EE
SHA-256:	FA3604528EE9A191BBFF70732B5136A10A127B61D26A3506B0C4DA0D0B97C2EF
SHA-512:	06F25E96BEC45DAE0E8A398E0927481838D02FE1F3F3DCCC3312F19C6D9FF78243BBBEEFD80862AF58E61B089CA682183B940A8668F14AD489EA1C9E3AB5F775
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493274304222","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\218b5ea1-8ec9-409b-9c88-d79cc45e5bf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20970
Entropy (8bit):	6.06564833342871
Encrypted:	false
SSDEEP:	384:CtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSCCz76t+xj1KgzFsGCxq57:WMGQ7FCYXGIgtDAWtJ4n1/6tMj11Bshy
MD5:	0074BB7909D61A70EBDA7206C73F359F
SHA1:	9F6EDE068DCD64E1A19B9C18E1FFE39D04B463C6
SHA-256:	C41D64B0D94EF92BAA06C63D630AFEDACB258D113007822AAF1BA7331BD6BDDB
SHA-512:	6730FB02A38F29550DFAD986E78B33DB4CEFC2A918035CA732961A540C3D7481FB5AD1197E4C11DC37FF4C989EB62073BA596786214ABB6B5755B73E7A95A5D3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493274304222","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\60babd47-9a3f-42d7-afcf-9a72b3041278.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24322
Entropy (8bit):	6.053365328628574
Encrypted:	false
SSDEEP:	384:CtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGRCVjRqdqVECzw20xj1KgzFsGCxq57:WMGQ7FCYXGIgtDAWtJ4nyVy2wzj11Bsg
MD5:	75E5B2C2181196A407B7D5FF90E04FE9
SHA1:	9C215F945081C562C121EB7249C8E6AF335C962B
SHA-256:	47C38505AA753680901506B8607CCF95340DC8BF2F254D88F8F87D0F3160728F
SHA-512:	40C1AAAA1533FACE95CAE9B5EB4A662AB2DFC89022945F5BD6912B94DBCE676475B0FEFBF51A81C62BEEBC165AB73606686CD5FFD933553F3B3F9FB2BF6AE766
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493274304222","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8e53e734-8ac5-4729-b953-c361d56cdb58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3334
Entropy (8bit):	5.601548201886791
Encrypted:	false
SSDEEP:	96:0q8NkC1fipvhQxVB0xuvyAFHJkXikcWSDS4S4SDS2AI4a:/8NbEpvgWaFpktx
MD5:	96838050F25CF29374787212DF6DFD4B
SHA1:	A9C5F74DED3AF9F7B3C49B96FBC82F2941DCBC77
SHA-256:	23D2AFF0509875934CADAE4078EDADFB52CD479D3659218EB00ABB50D322CB7F
SHA-512:	C6027888F6EFDE6EFE7BBD800671F009293F8D8EE6BC7FC35C269EC3FE6324D3622BBE2D44FDC2B8942214327CDB0348DFB500ECFF19D9F599EA18A8BD1EB2B8
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\492ae01a-c27e-4765-9baf-f22d52fd04c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1B618-14C0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049410519857579
Encrypted:	false
SSDEEP:	192:06RUjLYiVWK+ggCd1LJtD+1X9XC4oUgV8v4MhZvNEfbcRQM9IFMn8y08Tcm2RGOD:9UjjlX620hFuQ+FM08T2RGOD
MD5:	A94E30D810A3E63B52614DA6F939B586
SHA1:	B67B7FDCD755AF2B80E4479ECB84C197D4DBE367
SHA-256:	DCE328AF991401C7DC0FDE200B15BD8E2E5E822EC489029C4852C0248C7D6D73
SHA-512:	6EBB1F2B9766AB0F844220F61E102086A74B00368A29D2F7027EE0F25A0222D7AE1430BB93F32DA8E7A4F27402955A38D4A82DCE93D49A92C01A2CCD9640CF74
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mudolg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...................................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....+...U@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1B618-57C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4598011354575305
Encrypted:	false
SSDEEP:	6144:+59nFOSnhvaHIOchh4ImN8QwaHh9EHtn:WnhiHk
MD5:	A25B47DF9402C032C75F6BBDAC894001
SHA1:	A27D98FF111BA1F0CB09C4206B7B60DC3ADD8107
SHA-256:	8F8AC97470A7EDECA70F55222B78211FB9C4DB37D5399F1BF5FFB74683EF114C
SHA-512:	85ED58B238697FCE85AAE08B9EC6500C9F6B50547AFF239FC5710898284C672E9AB6E7DEDF7AE0A575D965D29F4BDB6212A0B66857B6C43CB6F35327492B3B4E
Malicious:	false
Preview:	...@..@...@.....C.].....@................Z...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".mudolg20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.14108472525618
Encrypted:	false
SSDEEP:	3:FiWWltlqMCUeHSRqOFhJXI2EyBl+BVP/Sh/JzvWVTSfc2sUVstCUw+ltl:o1qMCUeyRqsx+BVsJDW5SfcJU5UwaX
MD5:	27749A7821AF47FE2E923BE7AA309762
SHA1:	46A028200AF7FA780B99BC2A63EAD80E732A7E75
SHA-256:	6B82053904ED2495285D13471A999AE368D9F01D3551B0FC1E39C3EA91209C67
SHA-512:	62E450F1967797578767FEB460965E27B41EC675C46F8EAE1E776AE161191D26A5662218BB6F45D989CEDC7D2370CA7D2A55BFB465E92B74C51F6D3FE6095164
Malicious:	false
Preview:	sdPC...................._,U.N.g@.....g."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................61806765-d9de-4105-97a9-5f5ff0861415............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\05f71bc6-8476-4b6c-a24e-712c87b6abf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565956319506546
Encrypted:	false
SSDEEP:	768:bzOvOFWP20fFt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfe+uNrwk3pGtuw:bzOvOFWP20fFtu1jae3u2xtT
MD5:	10337DEE8F576CB5E448B8395B5D6BCE
SHA1:	A175EDB0392707FDE9C4697A82E52C3B6D1180EB
SHA-256:	1D9A32665D7C3AE88A9D55CCC49E7BEBA4569070583278B358AA956D4C9156AD
SHA-512:	7754D0F4FDD537708DAFFCE9F7CF613227E4AA1A47D6094183193EE2F81D7EBA64A5B2457CF523B55FDC98406F89066500F59364FAA9D3C4AC4B7BF58898F80F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493272834725","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493272834725","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1f3c8e5a-0a54-4061-904a-596c5ea78179.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.980100011375425
Encrypted:	false
SSDEEP:	96:stHqf5uis1Jb9Mb+XN8z/s85eh6Cb7/x+6MhmuecmAeiPquQ02MD/EJ:stHOsscNk/s88bV+FiAgAPDMJ
MD5:	2905F780F4BA38A1C5F84424AF339CCB
SHA1:	A8230427A85D087D161A4B2E27E7C8D694E8CEA8
SHA-256:	7B4AFCC05CF0A0C9968F7CBE7B4B2B6B0517E2E698927B25372E28D77C2D514E
SHA-512:	1EC1A880B8999D4850DD54AC25D71D3C267181E08F9193A71362FABB3C42DE344332A3121A5C833D4D2C54C02BD5A5A397B1E2D3BDEE4962F850A1744E862721
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369493273662021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369493273662725"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\23b09d90-f7c4-4e1f-828d-e0ee8be4e884.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3c3b6b81-4d88-4111-b002-16dad65644c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.978064753457646
Encrypted:	false
SSDEEP:	96:stHqf5uis1Jb9Mb+XN8z/s85eh6Cb7/x+6MhmuecmAeiPEdQ02MD/EJ:stHOsscNk/s88bV+FiAG5PDMJ
MD5:	C728539D160401B9E57A9C34FDB35EFC
SHA1:	B5B36F01729D66A72AFB1A7F61D0F2B44FB3915A
SHA-256:	9F4E411E2CA56A500AA65188EA43B45C20147F68F52A1F22D76CB0D89765F908
SHA-512:	B81632A8FBD97D8DBF80F1950BDF7A21581EB8D5D2D69834D835A33B6E56774C3925C92A4E06940439BAD94D5732A6756DBCA312491C9BF6D1695A63EC355AA6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369493273662021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369493273662725"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\65c17a41-1202-4824-a05a-30cd6e8b6f3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565850549957861
Encrypted:	false
SSDEEP:	768:bzOvOFWP20fit8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfe+uNrwk3pGtu1:bzOvOFWP20fitu1jae3u2Rtq
MD5:	7941BA82B1D625F29954AD8F6BAEBDBE
SHA1:	C32176453395B9BD07AA0CC15EB8A051D6F6E52B
SHA-256:	0F722C9058539C09DF485F146EDD8297773292C8175A3C4C416E25A7F7135D0F
SHA-512:	3F2E5CFA5D8FE5373202268310847B4CE46FF8859377A86EC5EE5A88F628171CB6812983E0DF79323EDB793BEF224CEF3E49E2C90E17946903FB3B6E4BEE04F0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493272834725","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493272834725","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\98d14a99-ff95-444e-ad3b-9dd1c56ae204.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.32057341865233
Encrypted:	false
SSDEEP:	192:gAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:TOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	B8140675900124205DA670685FA5C61F
SHA1:	64D945CA00ECE51EFFA45C360998FAB250A9C1A1
SHA-256:	277A51CBE65720D317CF4906B358E8FF5E4988FF1CCA739D7373C6CE0033F7DE
SHA-512:	C96B85DCB620804EE7825645A21E4954DC690E4DB385FD7EC05C71EA3D1C783400932D3B1DB935B7E3946DE237FCB912BCABF6BBD2DDD66106A0B32004F997AF
Malicious:	false
Preview:	...m.................DB_VERSION.1A.:..................QUERY_TIMESTAMP:arbitration_priority_list4...13369493278036078.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.131531530746196
Encrypted:	false
SSDEEP:	6:to9s1wkn23oH+TcwtOEh1ZB2KLl7GM+q2Pwkn23oH+TcwtOEh1tIFUv:y1fYebOEh1ZFLF+vYfYebOEh16FUv
MD5:	14322DCCB4EA1C7F77E8C1FD14ED84E7
SHA1:	4DFEB9FC82812B94D14401A6DA3694ECECCA13A0
SHA-256:	0661A70B54B661801F57A93F5FCA399A4A16AB2A219385C584E3CF463D60CBF4
SHA-512:	D7E1A20AE11B1A9D9FC4F07C936856558751D3C523CEEF1E8BB017B02F5469FE984543E5A2A5B602CCC9FB8EAF0603C26791403FC2D1F222278E0C1DBED67085
Malicious:	false
Preview:	2024/08/30-08:07:57.291 21ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/30-08:07:57.332 21ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04390356483441177
Encrypted:	false
SSDEEP:	6:/Fii2ZfUkM/laoKqhree4+VwTGkllMl//lA:dKf9EfhrbZ6H/M7A
MD5:	ED4C3AC15F02080EF2AEF3596A21A752
SHA1:	164FC764A11BA4D3F39443FF9F0670E463EE2EA0
SHA-256:	631D2C771A774D2EB14461BB596612A58D8A7C60E879E16CBD55E7A5CBA3D24F
SHA-512:	044FE5EC06A310A3BFD47046BAE5232581067372395B9D98EB8AC912CC5B9501EF73CA49D8E657946C02F90632CAADB41EF992BB03DA06013A3856AABEE0EE46
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09576564694228847
Encrypted:	false
SSDEEP:	48:t7/bV4A3esyV4XesrAzNUeT1sE6WT3lWp4:t7/bV4A33yV4X3rAzNLKE6I3L
MD5:	888EF470E151617EAC2314A05F3D8726
SHA1:	DD960DE17A8D4265B7D5B941F482077D52B212E3
SHA-256:	9EF4C21C130CB9609F9AD0DC406DF8D37DF401A02D17F33E10E0BA72DC671795
SHA-512:	FEBAF3190313C94FC3EEC98C18AFFEE1B18505AB812D2B1E9F02A75BE51D99DF773208D3D2088EE11D52E6E9986F9DE5FA96B2B4523607DF1CD6CE3D1A89EB34
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2833151349816048
Encrypted:	false
SSDEEP:	192:3qEXJZbtMXWqEXJZbtMXXtUwl5JZbtM40wx+c2JZbtM4kt7q8c+VJZbtMynU6v1x:3vJtMWvJtMX3JtbVcJtbwKCJtp
MD5:	48D496F5FD7549B8EB5A580218EBAFF8
SHA1:	7583FD0DD48E05B361C9595F3C0A8EC8C49813E9
SHA-256:	4F130B465FA0F844A03525B7917C63A33D5EBD54E933D14134DFC6999DC744A1
SHA-512:	675BCCED5BAACF3EAD4065844009713CE81DC53EDBF14866B1F19B6AFECFE7EA1BB95494C62529CEDD20FEC6491C3FBB2EBC3F8386574552B3C6291770BDD5C8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulhZl:LsG
MD5:	1AE800E5485ECFDA3BB96B32DE6D474E
SHA1:	0A01F37ADFFC901F7F676726D4EBD8EF174F5C27
SHA-256:	750963291FE402E2E52B11930CFDA8E77B1257FE8335221BBAF7EE9F645ABA03
SHA-512:	E333B9809780373DA5FD6229EB852309CD5B4B19A2B19274D83B19F56549742AB35695D6F2C678D6D925F162D70377533DCD360D192F33F20EB0945CB89BD5E3
Malicious:	false
Preview:	........................................,.x.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:S2PFjEruJl:S29wrur
MD5:	C4671E0F8F4E775A8DBF2BAC111E96E7
SHA1:	72BAD29359FEB3BF67506F4E7F2EEFD9353C7643
SHA-256:	90311CF294DDA382010F0ED2AE7BA31F5A4F016681A2790E17EB6A7C13E07D8F
SHA-512:	77ECA9F2A9F7E1A249444B7972AC19DCD4A702DD1338A1073202BD40733728AE15B4D23ADE0D3D207333AF9CF35E2FAA9EC201A11D8EA85D7DB94AA9F993B3BE
Malicious:	false
Preview:	(......joy retne..........................^.{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:S2PFjEruJl:S29wrur
MD5:	C4671E0F8F4E775A8DBF2BAC111E96E7
SHA1:	72BAD29359FEB3BF67506F4E7F2EEFD9353C7643
SHA-256:	90311CF294DDA382010F0ED2AE7BA31F5A4F016681A2790E17EB6A7C13E07D8F
SHA-512:	77ECA9F2A9F7E1A249444B7972AC19DCD4A702DD1338A1073202BD40733728AE15B4D23ADE0D3D207333AF9CF35E2FAA9EC201A11D8EA85D7DB94AA9F993B3BE
Malicious:	false
Preview:	(......joy retne..........................^.{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:0ldEkv4C+:08m4C+
MD5:	468D0CB7D0F5ECED183D395F8749F9F6
SHA1:	C483F8CC05C4D20B84C7A66B2C8CCECABA28E355
SHA-256:	9D4FEF496AF6A98F1DF3BBAFD583ED1ED0B5735F58C4158DBB22412F14E3F7FD
SHA-512:	4F8124039AF85619BE8F66E0F48A2856632721FE70ABFBAB1B217F264A9A84BA4C228CA793F6FD7408A942DDDB9D03686E5DC8C29FC406C2591D9BA14683797C
Malicious:	false
Preview:	(....q..oy retne.........................J].{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:0ldEkv4C+:08m4C+
MD5:	468D0CB7D0F5ECED183D395F8749F9F6
SHA1:	C483F8CC05C4D20B84C7A66B2C8CCECABA28E355
SHA-256:	9D4FEF496AF6A98F1DF3BBAFD583ED1ED0B5735F58C4158DBB22412F14E3F7FD
SHA-512:	4F8124039AF85619BE8F66E0F48A2856632721FE70ABFBAB1B217F264A9A84BA4C228CA793F6FD7408A942DDDB9D03686E5DC8C29FC406C2591D9BA14683797C
Malicious:	false
Preview:	(....q..oy retne.........................J].{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYl:Ls3I
MD5:	4C22FFA228076F8F9830AFECAD7AA21A
SHA1:	E0388B746C5F57A310D16553E788A6408D9D4FBA
SHA-256:	0F4541DD339BF940A06DF631E6B5FD682383AC3C6DF4D37CBED31FA0E734A89A
SHA-512:	4A943AB4603CA31201E6D6E4514D58CEC2169361C59843D44048E96135D33EAB1B41677C18E8B2DE2A0AE377E0457E73CE08F950CD5B040C1CE3926C79617F54
Malicious:	false
Preview:	........................................j.q.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354070337889007
Encrypted:	false
SSDEEP:	6144:lA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:lFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	7A5B2E142A3660D4A7ECBC450D32FB5C
SHA1:	53EB9A4D0AFD1CEE207BE225B21D59164D466AA7
SHA-256:	FA1A64F0E6369A0BDAC841F11F45DCDEDE1DD016DBF4C7C1EC65120D82C90983
SHA-512:	2E9431FD123C28AE5B0C79E3D43E791D537A730AE2AFBF8B7DB5068490790FB178CB3BF5F09415C4B295080CAFCD886CF34260F39B1E1BC1FED723A72DEA8A05
Malicious:	false
Preview:	...m.................DB_VERSION.1.HDeq...............&QUERY_TIMESTAMP:domains_config_gz2...13369493278110187..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.209103421119976
Encrypted:	false
SSDEEP:	6:tHF2q1wkn23oH+Tcwtj2WwnvB2KLl7IXL+q2Pwkn23oH+Tcwtj2WwnvIFUv:rKfYebjxwnvFL+XyvYfYebjxwnQFUv
MD5:	4722FAFF1EF63CA531A126309736E697
SHA1:	0CD88AA0EE5B98A3D3818BD14F17274CF422847D
SHA-256:	68DCC2C59E5D96608694809AC901EA07D5E3C97581409199762305CDDB08D7E5
SHA-512:	324147A3B54491CA158F338E3F34799DF225AC5EB526878F13282437BCE3C170E538686704290CC33AE167C9DBFF118DB39AF2C25C3B852719AA48B283B32BBB
Malicious:	false
Preview:	2024/08/30-08:07:57.331 21c8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/30-08:07:57.417 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246182563867
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RK:C1gAg1zfvi
MD5:	CB4213EB294D92C3C02C90E23934F1D7
SHA1:	88C3098E2A94B56E590783C1DBE39FCCF3FD8B88
SHA-256:	4069481807B8490C778DB2D1CD887018F0108CCBC5763FC7255EC8983D2933BA
SHA-512:	CB0CF9DDCCC0F6E3C9721BBCC61FF922E5479CB28DB94BCD8E12FF0DF00C8C4BBD3C3CBCFCACD231FCBBE80EED667509AF53318AE83BA016DF31A239687B0D66
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.185436783056433
Encrypted:	false
SSDEEP:	6:tpuAFFB1wkn23oH+TcwttaVdg2KLl7JuAOq2Pwkn23oH+TcwttaPrqIFUv:igyfYebDLqRvYfYeb83FUv
MD5:	87F9180E68C2A0F1A4F0E099F2B32C4B
SHA1:	076353A830E92CBFD6B2EF0259A19AFB04E04AA4
SHA-256:	91FB9FAE91AF3E36AA20EF49DA9750D2CE5736316BD2D55C7FFD9844BCD97DD2
SHA-512:	EB1A1248E046A693EDA50F2949B29398991C226CB5D0D8D8D743ACF4E0C8774C023DD83FF6A3A31BE3072F7463C1812017BA729C9D8C51142171D32B93C6E4BF
Malicious:	false
Preview:	2024/08/30-08:07:52.844 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/30-08:07:52.880 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.177589607226095
Encrypted:	false
SSDEEP:	6:tBjB1wkn23oH+Tcwtt6FB2KLl7wUAOq2Pwkn23oH+Tcwtt65IFUv:MfYeb8FFLbRvYfYeb8WFUv
MD5:	43CEA989558E65F7885A3DC1E274C26E
SHA1:	192926DC7E7F380384E5325E7870896C9E954E82
SHA-256:	F40999A8B55FE6250A52728D4DDE6F66E56DC11250331453D720ABC43A6D2316
SHA-512:	7418FD272DB842823A37FCA777997D73AB23ABF475714A4636B950C26B976B25ADCBBD68F4B8E176F80823FB6711D24013FD8324C7235DA3663B2B3FE1EF8E97
Malicious:	false
Preview:	2024/08/30-08:07:52.888 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/30-08:07:52.908 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.179192199422261
Encrypted:	false
SSDEEP:	6:tOKm81wkn23oH+TcwttYg2KLl7P+q2Pwkn23oH+TcwttNIFUv:kKyfYebJLAvYfYeb0FUv
MD5:	F42ED5CC089468EEFFFC7CD9DB9F2F7D
SHA1:	4E5FC6E599A4853F06B07E75B739280253017D3C
SHA-256:	B9AE5D550B3FE01308B08D790B96A071D898E6AFA5D258F054DBEACD74779552
SHA-512:	EE4983980207F167A2FC359F21BCBAAF7BF35E98FCF7E7EAF62D70651907495AE9CDFC906D9C8DC8991F6F313CF74AA9A2635E561CA2AEC1C10C8CAB210FA41F
Malicious:	false
Preview:	2024/08/30-08:07:54.405 1c78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/30-08:07:54.416 1c78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlZ/l:Ls3Zt
MD5:	D5EC0710BDDBBA551C36DDCC22EA7B75
SHA1:	2B2823C93B999D5EB6DFC0803D890E8A6225AF8E
SHA-256:	72154562922DE66B02AFFAEFB07B4C6CB88D02FE30C7495AE497467EEE2AF230
SHA-512:	C21D1730630A193F67AAE2A04F20B3F783A3E00662D67C71C163F6FD0A45382943E6FEE14729335012DF7E88D082D52C2FFF77C3CC0611EC113AF4768E09A9BE
Malicious:	false
Preview:	.........................................#q.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:U/RtFlljq7A/mhWJFuQ3yy7IOWUJHdweytllrE9SFcTp4AGbNCV9RUIb:UC75fOLd0Xi99pEYp
MD5:	632CB7102672A11FE5CEA19E02C6AE11
SHA1:	038216A0F2F44E8DB0C50B63672EE985395F3A43
SHA-256:	E4251A327FD0C5D5FBFE7D1FA2B25021CB1E9522941F96AC302E9DD43F4678D4
SHA-512:	B57884CE7EED5D2BB6EEB1455C8762A5A65AD03B12090A9BDD99E641CD8322CE296F4ED10FBB9F4E7B1543E61FA386BAF4CFA723B2653497E3DB40A7F6389066
Malicious:	false
Preview:	............^.(....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.232433315333596
Encrypted:	false
SSDEEP:	6:tOu1wkn23oH+TcwtRage8Y55HEZzXELIx2KLl7KcM+q2Pwkn23oH+TcwtRage8YU:2fYebRrcHEZrEkVLNM+vYfYebRrcHEZJ
MD5:	0A2E45216ED009F472A74351FE61CDA1
SHA1:	280207AE177D9BC7C2AD07BC60FDE71B3ABE7A56
SHA-256:	28B2FAC677050EACBEABAD572CFCBADA72CBD22CE4DEAC2154311FE5494D5212
SHA-512:	6467DF6936F8FA4CB66CD0D5FAB82D327032898D3055FAC11356D0C0D35BAF32D8E393183B36E82959FD9EDFBE3848CBF97F81A18D2A40E6E6DED2EE5DCEB2AA
Malicious:	false
Preview:	2024/08/30-08:07:55.383 1c6c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/30-08:07:55.430 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.215259441893868
Encrypted:	false
SSDEEP:	6:tVax81wkn23oH+TcwtRa2jM8B2KLl7CFUT+q2Pwkn23oH+TcwtRa2jMGIFUv:XaxbfYebRjFLQUT+vYfYebREFUv
MD5:	77AD3345874CBDA765DFFE7C94D2678E
SHA1:	6918B0EC1E2F4D8786425490AE5F34285426FEF2
SHA-256:	9D1D5B69E8DB9708489A664F5465C467FC5339CDBCD7A72C1BA1F495C2CFD39C
SHA-512:	AB92CC473E5E737B7E9D162603665F4EA7A92A16A62A731A1F6749E525A1F0CB49BAEBD60918CCC31FEF6934D060FBC48560A64EC2FCA59DF086F45EB0781C33
Malicious:	false
Preview:	2024/08/30-08:07:53.189 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/30-08:07:53.222 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\14b294c9-17ff-4ed9-8460-b0da7db43bab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\7fe1fb2c-aed5-47d5-b73f-c61899379f38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\8b0346f2-3898-461b-ae67-c50fcf4cc5eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3ad29.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7603929943241204
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkT9:uIEumQv8m1ccnvS6Q
MD5:	970349FD14EF98328F23D328662AA8DC
SHA1:	BAA00579180ABDCAB923177D5813E538D1DA526B
SHA-256:	38F5D32974F6E3F3AC337C6EE10D7F8DBC18C4F50443E8C2FF3E4FABD7E02089
SHA-512:	6E431B433DC35D5B73601B223F2BBCFB77F690FE4DF48F65A735F010B79DA17A8DC0AA9D0208018CE3C8CD7CC1AAA7F212AF360CDAB3F13D344AC9669A801202
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF28dcf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f92b474f-38f6-4a16-b5ea-1356a5a28d53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\fb98bec1-8089-482f-8e78-a6758495ac39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970552664059559
Encrypted:	false
SSDEEP:	96:stHqf5uis1Jb9Mb+XN8z/s85eh6Cb7/x+6MhmuecmAeiPu52MD/EJ:stHOsscNk/s88bV+FiAAPDMJ
MD5:	1CDDDDE652824E095DA587821F395657
SHA1:	C47E94EB0F5795A305CE26AC4BEF175C72D43640
SHA-256:	BE158717FA98BFD5BFC5E9168E79D60E63AB0825529AD061762097FBC8F9B3E8
SHA-512:	C231EC559F80945FB79CFDC07DF438E13ED5E8FCFEF443BD4759BF253993DBC4A9E103BCD90DDDC49948576CB90AD24F7FE46968EA6023FAD308CFBC3540AAD0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369493273662021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369493273662725"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF31eb4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970552664059559
Encrypted:	false
SSDEEP:	96:stHqf5uis1Jb9Mb+XN8z/s85eh6Cb7/x+6MhmuecmAeiPu52MD/EJ:stHOsscNk/s88bV+FiAAPDMJ
MD5:	1CDDDDE652824E095DA587821F395657
SHA1:	C47E94EB0F5795A305CE26AC4BEF175C72D43640
SHA-256:	BE158717FA98BFD5BFC5E9168E79D60E63AB0825529AD061762097FBC8F9B3E8
SHA-512:	C231EC559F80945FB79CFDC07DF438E13ED5E8FCFEF443BD4759BF253993DBC4A9E103BCD90DDDC49948576CB90AD24F7FE46968EA6023FAD308CFBC3540AAD0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369493273662021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369493273662725"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF393d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970552664059559
Encrypted:	false
SSDEEP:	96:stHqf5uis1Jb9Mb+XN8z/s85eh6Cb7/x+6MhmuecmAeiPu52MD/EJ:stHOsscNk/s88bV+FiAAPDMJ
MD5:	1CDDDDE652824E095DA587821F395657
SHA1:	C47E94EB0F5795A305CE26AC4BEF175C72D43640
SHA-256:	BE158717FA98BFD5BFC5E9168E79D60E63AB0825529AD061762097FBC8F9B3E8
SHA-512:	C231EC559F80945FB79CFDC07DF438E13ED5E8FCFEF443BD4759BF253993DBC4A9E103BCD90DDDC49948576CB90AD24F7FE46968EA6023FAD308CFBC3540AAD0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369493273662021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369493273662725"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565850549957861
Encrypted:	false
SSDEEP:	768:bzOvOFWP20fit8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfe+uNrwk3pGtu1:bzOvOFWP20fitu1jae3u2Rtq
MD5:	7941BA82B1D625F29954AD8F6BAEBDBE
SHA1:	C32176453395B9BD07AA0CC15EB8A051D6F6E52B
SHA-256:	0F722C9058539C09DF485F146EDD8297773292C8175A3C4C416E25A7F7135D0F
SHA-512:	3F2E5CFA5D8FE5373202268310847B4CE46FF8859377A86EC5EE5A88F628171CB6812983E0DF79323EDB793BEF224CEF3E49E2C90E17946903FB3B6E4BEE04F0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493272834725","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493272834725","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2ee00.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565850549957861
Encrypted:	false
SSDEEP:	768:bzOvOFWP20fit8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfe+uNrwk3pGtu1:bzOvOFWP20fitu1jae3u2Rtq
MD5:	7941BA82B1D625F29954AD8F6BAEBDBE
SHA1:	C32176453395B9BD07AA0CC15EB8A051D6F6E52B
SHA-256:	0F722C9058539C09DF485F146EDD8297773292C8175A3C4C416E25A7F7135D0F
SHA-512:	3F2E5CFA5D8FE5373202268310847B4CE46FF8859377A86EC5EE5A88F628171CB6812983E0DF79323EDB793BEF224CEF3E49E2C90E17946903FB3B6E4BEE04F0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493272834725","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493272834725","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.103437357974648
Encrypted:	false
SSDEEP:	6:J8VsgV81wkn23oH+TcwtSQM72KLlP8V/N+q2Pwkn23oH+TcwtSQMxIFUv:J85VbfYeb0LB8hN+vYfYebrFUv
MD5:	1A7E50BC3F6AFB61548932DD17E1F636
SHA1:	6C9B4DA4DB74DA4E89DC30E5847536B8B68A859C
SHA-256:	8044B199F5DEA16C629B2A7AFEBD393FAE782546846D885A14F15CCE42DB922F
SHA-512:	21ABF0158339A23EADF3EA1E6D3D28B50FDEA2754162A03722F36020C10C6176BCF7589D295C9159662FAE61CC78B4CC0997312D8155361A297A77966831D2BE
Malicious:	false
Preview:	2024/08/30-08:08:10.307 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/30-08:08:10.328 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.108539832883296
Encrypted:	false
SSDEEP:	6:tRB1wkn23oH+TcwtgUh2gr52KLl7kfgq2Pwkn23oH+TcwtgUh2ghZIFUv:gfYeb3hHJLyfgvYfYeb3hHh2FUv
MD5:	BC936AE7712454AC554F5C7A9682D01A
SHA1:	E5411C8B95088FB2288F0A98D6D2554A9419D387
SHA-256:	F90490AA4DFAE9858B901BF6428FD70BB92C41E66FEC238B0D5B30CA9A0B4DFE
SHA-512:	588BBA8EDB823844D5F2768810B12C1B170C5AAD7A885F2DA1CC0805937A9085B5CCDDAD888B4CF10B6F55EFC4C34B52CF81EA26FAC851CE16F7FF031A388C8B
Malicious:	false
Preview:	2024/08/30-08:07:52.817 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/30-08:07:52.841 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulEx+/l:Ls5kt
MD5:	F67E65FE540269238095F2D4D34F4CE7
SHA1:	48487AD353ED1966FD50500A2713053793A2B1B9
SHA-256:	E3885F43D12C15F053A76910C35B5E4F959B3B38C885AE768AB97B2FC8415550
SHA-512:	1DD64AB97862355E351F4BC4C122C35A9AAB0E1B7E73755450B700A62C2D7DD357B0E45047BEE8292237CEB059B01418C01BA7222699574DB8BB1AF89E819F13
Malicious:	false
Preview:	.........................................6..{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:zghHFE0ESwMF+:MgoQ
MD5:	A7A78736B099CED5F8A56D69A4EBA7B0
SHA1:	9E26F21DA4E2B3313A8651EC194B13622817E38F
SHA-256:	0ECC243E38A02CD8C63842CDBAF2A62BD28EC4698A79F49A5D6C05B0ABEEAC13
SHA-512:	250C26CD559D59940A281E5DC6BA6A224018D5432A2E3E62926CD208B8EE653197EEC80683B005E5E37B50FC13170E1625F612F5A718BE4F00AAA0F24A79CE97
Malicious:	false
Preview:	(.......oy retne..........................r.{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:zghHFE0ESwMF+:MgoQ
MD5:	A7A78736B099CED5F8A56D69A4EBA7B0
SHA1:	9E26F21DA4E2B3313A8651EC194B13622817E38F
SHA-256:	0ECC243E38A02CD8C63842CDBAF2A62BD28EC4698A79F49A5D6C05B0ABEEAC13
SHA-512:	250C26CD559D59940A281E5DC6BA6A224018D5432A2E3E62926CD208B8EE653197EEC80683B005E5E37B50FC13170E1625F612F5A718BE4F00AAA0F24A79CE97
Malicious:	false
Preview:	(.......oy retne..........................r.{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:0mzEkH6F+:0mAO6Q
MD5:	27671403CEB82D96D1EFC2C40993AC64
SHA1:	06748A7C86CD83D6606362FE241E442FD388396F
SHA-256:	B7DB4426BFB08134374D45DAEE9323E7D4C9E4708DA0ED95CD693A421E963A6B
SHA-512:	994398D0ACB8BF516A58AB4E218418B8D58C35845E3BD2EA629A4878C12F72D22D16810EF2A4DFB930B1D64BC72D2376CBCEE0541FCD586E0A42BE6ADEFAF9B9
Malicious:	false
Preview:	(...i...oy retne........................x.t.{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:0mzEkH6F+:0mAO6Q
MD5:	27671403CEB82D96D1EFC2C40993AC64
SHA1:	06748A7C86CD83D6606362FE241E442FD388396F
SHA-256:	B7DB4426BFB08134374D45DAEE9323E7D4C9E4708DA0ED95CD693A421E963A6B
SHA-512:	994398D0ACB8BF516A58AB4E218418B8D58C35845E3BD2EA629A4878C12F72D22D16810EF2A4DFB930B1D64BC72D2376CBCEE0541FCD586E0A42BE6ADEFAF9B9
Malicious:	false
Preview:	(...i...oy retne........................x.t.{./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlKQl:Ls3Kw
MD5:	6972DFFB2CC4C0CA592DFE5E21B5560B
SHA1:	E30F85CF4B212F5E1727FA3406748434B5F34B9F
SHA-256:	EDC8EA5CFBFB722D2C2C1473EF006B91BECC538523E7F45ECFB09148D7992B66
SHA-512:	1DF43038B0F648D016DAF6EA9D907B444407E675AAA84EC5701DC766890D6714D8289D8E9296DE5F9CB5933B18ADE23614BF493F5B77FCBFF051AEC9AED03BF5
Malicious:	false
Preview:	........................................6 z.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlltl:Ls31
MD5:	ECD722C598F18BA65BB624CD4609AF17
SHA1:	D75671F8B821F17AB7297D255341BB948EE8C1BB
SHA-256:	3CC8F734C3B95D30F92D076488590118B26CD8561C7983A78BD33EBDE16CD10A
SHA-512:	3556A34C47C264C4380B7156FD50D452557168760B67863FBD50EB116A19F750D5EBCC3E05E1EE81A5A7D254EDD15301D5B879E989E36A7F642008AA2A990166
Malicious:	false
Preview:	........................................wOx.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.220336523770777
Encrypted:	false
SSDEEP:	6:tSc81wkn23oH+Tcwt0jqEKj3K/2jM8B2KLl7/YB3+q2Pwkn23oH+Tcwt0jqEKj3V:zbfYebqqBvFLM3+vYfYebqqBQFUv
MD5:	36DAED39DE8997908E597B2D71EF77E4
SHA1:	FE525382B58A5A6DF1FB76CB9D1A7D5A2D708D3B
SHA-256:	A002593A324FC61352AE70417DA19C1095859ACCB3C44CF20CE839581868F7D1
SHA-512:	4BEBD98A9D9FA3BA1EBBFE5E48ADBB2FB85141B53D9FCFCD9FF20AEF2213EAF0C3D93BD2E92443BE823A4F9EAA8B1568BAA9B37D6C9D1D6AC7C2495A36FC9DAA
Malicious:	false
Preview:	2024/08/30-08:07:54.820 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/30-08:07:55.234 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\053113df-a998-409d-ba75-3ec06b4b539c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\080c6810-db96-490f-a19e-e3489d19e157.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\794b2cb4-5b95-4110-8be7-7ff619018f17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9e569122-c211-40e4-9c84-2eab80dcb521.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3ad96.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.190873415783386
Encrypted:	false
SSDEEP:	6:J8VGx81wkn23oH+Tcwt0jqEKj0QM72KLlP8VZ3+q2Pwkn23oH+Tcwt0jqEKj0QMH:J8qbfYebqqB6LB8z+vYfYebqqBZFUv
MD5:	B882780339402DB170ADB3512B5B8BF1
SHA1:	40C7CAD5E36DB247F035C830CD70F3B8021CE81F
SHA-256:	C5D33C331803EFCFD2B31A5EFD417F775A84AB179B65A86C63503FA54FF0C188
SHA-512:	7F58AB4D000C4F68D8680251502F3B1E0A162943FF06CF5525ED5763227A4E69F1324253551E6F8B01F6A256390EFA5D58AE0EC49BC582AE2CBA558B36965B70
Malicious:	false
Preview:	2024/08/30-08:08:10.425 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/30-08:08:10.456 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.212442004865167
Encrypted:	false
SSDEEP:	6:tRsSM1wkn23oH+Tcwtkx2KLl7VxXq2Pwkn23oH+TcwtCIFUv:fDrfYebkVLPFvYfYebLFUv
MD5:	C48611A1DA66BCA48D62A0C936EBC955
SHA1:	8760605D0BBEE3C4E9D11DC4C0739752339B1BDD
SHA-256:	D393C7FDC1D98C8F34A8AFD44A6E33B20B1244A620BFC5892ADC9FAF731634A4
SHA-512:	27CB865371A9991F3BAC5F6C5D25DBE9DDEBAD44E638B5CE45774085D88AF2627B1A070D73FD9D6B48AA00A7604601FFC4D91EC29610875E99D9BB0685C3D209
Malicious:	false
Preview:	2024/08/30-08:07:52.833 1ca4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/30-08:07:53.142 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002095330713584969
Encrypted:	false
SSDEEP:	3:ImtV7iO:IiV7
MD5:	45C0985B9C3896112729BAE8940DB34A
SHA1:	08A300A1A3B14138F716CBE6CA062F5600725D37
SHA-256:	084869C551AEED86083EB6E37B3A4247DE8C45D55C18D9D700454A606233BC1F
SHA-512:	DF6CACC602AD48B1DC27D1FFEC921CB278D8C660DD52FAEEC88F4F08954019FF680408F99C23DC782845A05145088B6B57EF460AC5DB742117F2D7B6546A2220
Malicious:	false
Preview:	VLnk.....?........MhV.6.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0770217953726828
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOZSAE+WslKOMq+vVumY7zn66:e/2qOB1nxCkOZSAELyKOMq+vVumkp
MD5:	DA2D9F9A6A87145E1C6FF189E50601B6
SHA1:	1478982AA5CF82F3E7D2A589A591D2BF0CF1A4DE
SHA-256:	7B2F7DB334CB24201216E3A1FBDECB727AD4EEF962B817D7EBCE61A170CD1039
SHA-512:	89CA983798F2DE9EC70A95CE6A746B013C6602F93C802DB0D4B7214F3E914D016048BAC62ACCD7CE16DDBA125E07B815F16CA5A7DBA24EA911695A24D26A690E
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ce8b8ead-1a17-4770-9e7e-0e485b2629f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.970552664059559
Encrypted:	false
SSDEEP:	96:stHqf5uis1Jb9Mb+XN8z/s85eh6Cb7/x+6MhmuecmAeiPu52MD/EJ:stHOsscNk/s88bV+FiAAPDMJ
MD5:	1CDDDDE652824E095DA587821F395657
SHA1:	C47E94EB0F5795A305CE26AC4BEF175C72D43640
SHA-256:	BE158717FA98BFD5BFC5E9168E79D60E63AB0825529AD061762097FBC8F9B3E8
SHA-512:	C231EC559F80945FB79CFDC07DF438E13ED5E8FCFEF443BD4759BF253993DBC4A9E103BCD90DDDC49948576CB90AD24F7FE46968EA6023FAD308CFBC3540AAD0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369493273662021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369493273662725"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/2p7FlFll:7+/l/
MD5:	7CEEFF2535B92E1BDB8BBDEA0D1AB72B
SHA1:	A7174C5148786FBE2859DD72DED33418F12000BB
SHA-256:	8720885C820C7C6552460898F5F5F909AE5C234A68990D34EB0D61D35E2A92C0
SHA-512:	75E7D2849748601330D98E55CD7A0F20DA75CF45E9F77EC3035C2FE462AB1986C3FA2E35FDFF57E1CEF5E2493F76A2E82B909534E589342DF9D290237ABD9B7C
Malicious:	false
Preview:	.... .c.......=.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05022808509896411
Encrypted:	false
SSDEEP:	6:GLW0tsLW0tsylCL9X8hslotGLNl0ml/XoQDeX:atsbts26GEjVl/XoQ
MD5:	CA88DB9982306E70BCFA5715F4B1462C
SHA1:	183281EB9E5C82B7163D7AD1B2526869618B826D
SHA-256:	2C0D291FDB0FD3CC3D01B76C6F88FA99FEC9C3B621AC9171FD8876063684F9D9
SHA-512:	EBA7E590AD65640BB23AB51B08BF7F36196F595D630E73C9E8FAF7419D48F76A6CD30AAFF2FA6BD357BEDD817DAC959D32FA5BFCC9CD50BDAD620A50AA1A4650
Malicious:	false
Preview:	..-.....................0V. .r.eQ..)\|..:A'V.a%[..-.....................0V. .r.eQ..)\|..:A'V.a%[........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.998505615321015
Encrypted:	false
SSDEEP:	96:OvjxmJbOgJiwkPNsCrSwNsglPO5NswpAPNsuT29:OvtmJbOgJiwkWCrSTglDwpAWuT29
MD5:	911135278A786DB626DD4EF137607F7B
SHA1:	F65D9294069B85B3BA5FCCD5388C9F2A7BFFDF8D
SHA-256:	0E49719F46FBF9629077141BD8B11BEDA5279C7C70C891D9C9ED295B5EBD34E5
SHA-512:	455FA05B9F64E939F4B5202D5DF266DDD64506C1908BC8761D5A439F9E68A68DAD12A4E6BEDCD685105546A211DEE950B695FF5C9DB87AEC7990FA307E614606
Malicious:	false
Preview:	7....-..........Q..)\|.....d............Q..)\|..f....EG.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1535
Entropy (8bit):	5.495251810345037
Encrypted:	false
SSDEEP:	24:t8ZbLSBSKV/o/lPKJHRHSIIgt2YKIt2YKTKcqQNkQAMYKIMYKAyxAlkfAlkZETcR:t8ZbLSBSGQtP0HRHSxgIYjIYqzqqkHMB
MD5:	3316D9DEBD991E08305D3606B83AB79F
SHA1:	2A274F916E924C2BD588D385CC22EACB53537DB2
SHA-256:	7B8129A9C000198D067A53031EA6D46DF6F3B0CE8FE302DDDFD735CFAAF55383
SHA-512:	2C6CB1215CDA6CB517BF8DF47C8D6BE26F2B06EC88ADCFDD4CD862CFFDE0309C1F68272FEFDD5027D4CCC9C0A975B35D83CE6C6BA93C4C25868065905FA18716
Malicious:	false
Preview:	A..r.................20_1_1...1..F................)Z~..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_DesktopPwaInst

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.253708578738877
Encrypted:	false
SSDEEP:	6:tdL3B1wkn23oH+Tcwt0rl2KLl7i6q2Pwkn23oH+Tcwt0rK+IFUv:fQfYebeL7vYfYeb13FUv
MD5:	E9FC3A19138F5EB6F12F47480F9248FF
SHA1:	B53992EAB27900F948C22F635DA2001F9B6774E0
SHA-256:	FE79F85930ABF07E9654DC420DC6191137C49B4BFA5E6853BF66932D022B1415
SHA-512:	A33A7BA465982848ED4286AB2325E29A98CFE3F0BF365C2ECD9F462E4950B3795C21822A764585C652E923FBE13C77C84AE839E5ADEB87EFAA5EBA8C56D672AB
Malicious:	false
Preview:	2024/08/30-08:07:53.908 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/30-08:07:54.513 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.9476082623321145
Encrypted:	false
SSDEEP:	12:G0nYUteza//z32m5t/b8gA7QRmSnSedX2Ogp8mvRU0:G0nYUtezaD32m3bXESnSotw
MD5:	86CCB780B7DD8D880AB91C950088130F
SHA1:	9FB9ABB862B6BD8549AD5EFF19C12EDDF5B0D058
SHA-256:	46A4ED7EACA7D489BC1C35AB3413B9DFF0E7FBFADA2B85D03F343BB9A4C546CF
SHA-512:	60E48A7D1BC8725A8D2A4A1F00385EDEB4FAE6B9BFE846A32A6A6556F104CCF9A4945CAE55C797A0E4C2ED039FB8F1836F2A173EED03AF0EF26E6AD2A5687F1E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....5oP..................3_.......\4.................4_.....G....................37_.....[Q.\|.................38_.......K..................39_......R...................20_.....m..A.................20_.........................19_......ort.................18_......A@8.................3_......a...................4_......@o..................37_.....n5._.................38_.....LZa..................39_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.21680436550451
Encrypted:	false
SSDEEP:	6:tl1B1wkn23oH+Tcwt0rzs52KLl7xq2Pwkn23oH+Tcwt0rzAdIFUv:ufYeb99LDvYfYebyFUv
MD5:	BD1B0594E89E5DCDE281390D888B961A
SHA1:	B63F3511B7D37784038FD7C3E6EDE6DE5F5D75E4
SHA-256:	D28C71169537876DA89D55A42C499EEFD4746D7B029CB05AF0AA0462B57B4344
SHA-512:	F9E6A58BFAAF7E3558ADCF38A3923C7DBC62DEB3DC14F96FF0A5B405A027D8EA12B3F2E6BE0FDECF777B725037A470D8DABD2AE7C800600D3B4494145BEA87CD
Malicious:	false
Preview:	2024/08/30-08:07:53.818 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/30-08:07:53.891 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlAQ/l:Ls3l
MD5:	3C72FEE7EA2D433CF0CB764167AEB6F1
SHA1:	826E1DDBB54BC3C009F5E849E5CA7177E2911E19
SHA-256:	C8F4DFE145A3027011F3096F4BFA95BB306B7D4600D93EAED33F415E8794EF97
SHA-512:	A1D1D25267121D759A36618301F4A304B65697D65D318BE13223FB68013D80367E4EC6CE9078AA492AA57294F4B355C504A2AA9073E52E985EA6AD976200A3EE
Malicious:	false
Preview:	........................................9.r.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlstl:Ls3s
MD5:	27B78D36ABA5F019B0CCE742215B7B43
SHA1:	8E3AC88265DE580BD829AFD61996CF771239C361
SHA-256:	EB8A3BAA196F901FE3E9856385AFFF89C4CC3E2AF20A02BB7A1E613D903406A0
SHA-512:	3B580D212BD9B4A60BB40AA1C6F410B8FC4246D7DC3E0487456D8DBF99F85B81EF94F38F4DB4E977E342C74980CDF6BFA5E3DCC7CF8C5F2040C4C103E80AECE5
Malicious:	false
Preview:	........................................._s.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF280ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF280fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28274.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF282a3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2a9c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2de9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF332aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF36cc5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF393b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3ccf6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlVwllll:Ls32X
MD5:	9C3B7504048E41A69EE05D2B4614FD01
SHA1:	B2A57AB387E81E532B786B6D9BE34808BBE281EB
SHA-256:	20B9BCF795BCECE4409BA098DA439157AAA2CE2B9464022ECA09E7D8AED50147
SHA-512:	629AD431A152E2899B2A8DB4B96DAC5D553DCEC94BA1D0E3F5B48B5A0E64A733F5CCB212A3CA0793C3F1FA30E1855E62523A0AE571B319A53B0C6A20D0B7065A
Malicious:	false
Preview:	..........................................R.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b53bf3d9-bb31-40fa-9c0b-8db0edbc5ee8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20970
Entropy (8bit):	6.065622295474689
Encrypted:	false
SSDEEP:	384:CtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSRCz76t+xj1KgzFsGCxq57:WMGQ7FCYXGIgtDAWtJ4nU/6tMj11Bshy
MD5:	D399BE5B520BA7B48EF0AAB217E54318
SHA1:	F70299C108BA9B5E615352824D20FE67CA9E8252
SHA-256:	E1967D551DC1006640C1190035AF784BA9B0BB67952EF022D62E260806919B99
SHA-512:	B11DA5765DA8E825BD037F2EE8AADD58868EEEDA586FCF34A920C691AF512B6B4B23A88A53D9163AECDC15B76B758040A0329BD299D86CAAE4EDCFD07008AC64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493274304222","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\bfccfb54-540f-4664-8f8c-995d0e8659bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.530631608949152
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtsm32RPDt1wC/rvJARt6yikv3JdXBuBuwBQaRzNhfKXOQQRCYh:YuBqDPafiU+vwQWReIfgBzBQcHfKvB0
MD5:	96E979420B1D2F2A33D5E3D74FBC98B0
SHA1:	DE2E08FB7EED901BDDCF2EEA3B30E3B41C5E325A
SHA-256:	C926F6E2C7878D85CEC7216ACD747CF22FF541CDF6F74217222A201D8212136C
SHA-512:	F44CA4B1967C7D47CFD7A6BC0F93F8CBCED06FB52901626AB794F49BC36CBB5EA27A2A94B1D7BDD456BFC7F36264DDCE83F4315E34535FCE7E30136FC6D13CE7
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369493272281572","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725019672"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e0ca18b1-16e8-4f30-a780-11f62cc719e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20970
Entropy (8bit):	6.065652279359419
Encrypted:	false
SSDEEP:	384:CtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBScCz76t+xj1KgzFsGCxq57:WMGQ7FCYXGIgtDAWtJ4nj/6tMj11Bshy
MD5:	61054AA35AD0ECDB002655A1B274EDC6
SHA1:	474B225B8C8086178783AEDB799B4310D7B182B0
SHA-256:	FC5C0423369B87ED813FF208151BDDD335F6FC4D2CEAD0BF4E039391C80ED237
SHA-512:	F832FEE3844349A72BE8C849FB913965DE0CEE7F9240691859F14CA4707DA21A539274377C09E9631FDEBBB21565DA2EAD3A38ADA8036E2E9078673B91FE1082
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493274304222","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e917641d-5342-4633-bdaf-c409630208cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.575015379582764
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afiU+vwQWRNIfkHB+3drxbuvBQcYrRkeaJkXHikcOwlRrnEYq:Xq8NkC1fipvhQ9B0xuvy/kXJkXikcj5q
MD5:	F4D137E78E06866553A5C37CEC665C97
SHA1:	488DBA149FD24A3D167981F58447629BCD5F1E9E
SHA-256:	E384F6CEC75BDB8A0415601365759DB1B819D91AB06883F3B91F4737202A098D
SHA-512:	1E375E4E48F796A5C69C8C84828121C09EDC08C71B2FC8E3A7EBC164C87981B8C9191F0B5A43696F0877FF9A686DEE50A83958F2CEC4F9144203D9C7BB0B5E29
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"policy":{"last_statistics_update":"13369493272319078"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ecaf5aca-6346-4c6f-b324-22f682946e35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.575015379582764
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afiU+vwQWRNIfkHB+3drxbuvBQcYrRkeaJkXHikcOwlRrnEYq:Xq8NkC1fipvhQ9B0xuvy/kXJkXikcj5q
MD5:	F4D137E78E06866553A5C37CEC665C97
SHA1:	488DBA149FD24A3D167981F58447629BCD5F1E9E
SHA-256:	E384F6CEC75BDB8A0415601365759DB1B819D91AB06883F3B91F4737202A098D
SHA-512:	1E375E4E48F796A5C69C8C84828121C09EDC08C71B2FC8E3A7EBC164C87981B8C9191F0B5A43696F0877FF9A686DEE50A83958F2CEC4F9144203D9C7BB0B5E29
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAzXhK5sB1ekM5AMkjTziKo/AszSOYTjrFuGMWXLEXvEQAAAAAOgAAAAAIAACAAAAAVyv11jCmCxZpJK4XlyilmC1dvdiAQ9Nt2+geM/bu6OzAAAAClQKd/hfeCgySWePdOCRjvoxPwEsrW+E32loFn1bjH8COaJQhYoOO73/7cyZIiLzpAAAAAbiiRFIPwZ55SwvrSTLETINhElqrMUKpDsL9L3/9+jG8IrLzhDww/9SUA17urbmIKAJY50rxSwGTofdj/weM/sw=="},"policy":{"last_statistics_update":"13369493272319078"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ee8ea70c-dbdc-4171-8cc5-1d013ca061e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71128
Entropy (8bit):	6.0734053414378515
Encrypted:	false
SSDEEP:	1536:WMGQ5XMBGA73IBrU5gYY0fwEh1MV9ml408gpM1vdPwPdrBshUR:WMrJM8w3IJU5I0IEK9q8aYSPhBshy
MD5:	37EE4E3F287BD46539518C497E018505
SHA1:	835366549907E5C43E446E7AB95315845B250021
SHA-256:	BBCC3D6E38021426BA2EEF35494676DD0C0CE2CA5FBBAC8D524B808271A09609
SHA-512:	F0D92FE19673149A87BECA5EE5829F8D39ABA3317E39FC0573A0CDBE7699F7AEC54E3D0F22DF200EAA62BD3853993DF058A9F9DB5F095997ABD85E6192E13F06
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493274304222","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0281a206-ec74-4f5d-910d-e925e099b2d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.797850337054992
Encrypted:	false
SSDEEP:	192:fsNw60KeiRUk0QQlktF6qRAq1k8SPxVLZ7VTiQ:fsNwxQdZQ2tF6q3QxVNZTiQ
MD5:	9B612F1B7EE3D934CC6FAAE98E37994A
SHA1:	4CBF4E8C3714E8FD7C5B475CEADF47F754776705
SHA-256:	08306450268A4493FFC6A2F6180CC33E0B2DE86A63B7299EFD79582195A622BC
SHA-512:	3CACF338887CBC5687521727EFB5F7C419182D99C2C08E57289209940004C30EBBB7C0B469C5174682960CB530428FEA89A62ECBE66C8605B8C68DCEDEEA329E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\073ca20c-528d-4e90-9afc-221523e0f510.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.804114730586696
Encrypted:	false
SSDEEP:	192:fsNA60KeiRU50QQlktF6qRAq1k8SPxVLZ7VTiQ:fsNAxQKZQ2tF6q3QxVNZTiQ
MD5:	7E00137ABEE73B1DE0835C525098231E
SHA1:	188A54D31F767FDB72ADD351938220D01DE78EB7
SHA-256:	E6650D1C23162FFAEF6AF5613493110CB92551BFE750A904E5B0D3AFBD7A3F36
SHA-512:	0323494410DB519659040178C491031722C82FB81A6BE26030157E5EFAAEA1CAF998D4926BC3A86DB68F94D8933E5DF88FA85E1E90FD5753776D5A01D7A763D4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\40bd7226-7db4-4e41-8dea-ec2f8adc117e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9448
Entropy (8bit):	5.832460139397103
Encrypted:	false
SSDEEP:	192:fsNw60KeiRUkN1hQ5J1Hlktl96qRAq1k8SPxVLZ7VTiB:fsNwxQdbK5rH2tl96q3QxVNZTiB
MD5:	DCDE9FF08706D910C568EFDF3A457E6A
SHA1:	6597337B4E9FCE4935C8E361960CBD9C6448D81B
SHA-256:	98F553498A053ECD229A0E39D95A70FC8217DB77E2BA574EE73A3A20262121C7
SHA-512:	F3D6E64A9E8BDD03855D9212972D35708AD074E4FCB1C75755657EF04D0A7BE40491A1BE8580C815528F8BB3222DFCABCB0B921DFB56FA5F3E71A71FEBC4B66F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4628f171-3c5a-4bc8-89ca-935e844ed604.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.831302790007955
Encrypted:	false
SSDEEP:	192:fsNw60KeiRUkN1hQ5syLkt496qRAq1k8SPxVLZ7VTiB:fsNwxQdbK5jIt496q3QxVNZTiB
MD5:	06991AFADD5C5CD2BABF18EBB41F3665
SHA1:	50FDA8A39128E222D159199187282923E0054BC9
SHA-256:	C17B9771940272B7987C3FE8FF7DF9428A67F6B92A397BD01A75A586B8A4A2F4
SHA-512:	57D3BB361747CC9865869FDBD7758ABE84121CDD08FCEA6FA8E981D6155858E48D6D89324C8BB99FDBF90772175725B4923C04E1A62902E7C6F27530A3C5D653
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7d554727-7414-47ff-b060-3ff9bc92747e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.831302790007955
Encrypted:	false
SSDEEP:	192:fsNw60KeiRUkN1hQ5syLkt496qRAq1k8SPxVLZ7VTiB:fsNwxQdbK5jIt496q3QxVNZTiB
MD5:	06991AFADD5C5CD2BABF18EBB41F3665
SHA1:	50FDA8A39128E222D159199187282923E0054BC9
SHA-256:	C17B9771940272B7987C3FE8FF7DF9428A67F6B92A397BD01A75A586B8A4A2F4
SHA-512:	57D3BB361747CC9865869FDBD7758ABE84121CDD08FCEA6FA8E981D6155858E48D6D89324C8BB99FDBF90772175725B4923C04E1A62902E7C6F27530A3C5D653
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8078103b-3467-4206-b95d-d9046970f1d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	60049
Entropy (8bit):	6.081392880014429
Encrypted:	false
SSDEEP:	1536:xMGQ5XMBGD0af8dP0SwkuoM1CBeOq+L7/ZGizJH:xMrJM8hkdP0SnuuB99GizJH
MD5:	5EFB293E79ABA03E568612693B790FCB
SHA1:	143002B08E287FA5B29F3A6B08728DC84CB14817
SHA-256:	0805ED6E275CAE7733418EA5E68C3F43001BCA8C8B9FFEF204CA1725FD2BEDB4
SHA-512:	5FDA2AB8FB713D7CC42CED5D27FA1E50500DAC4F469BC1BAD486A8DAE4870E29A90619A78D800603F5D5980F7EC3356F38037C0C1BD8C5476C08FE5FA64B1B31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493286936445","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7379d005-8b32-4ca3-93d8-519a3559def7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1B626-2308.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3117567223010428
Encrypted:	false
SSDEEP:	3072:CMk8fDhllm2xMRa2sLmDKEdz76VbwPkXyefekytuCrEpCBNpJ9OqrHMfbIBLvpOR:5dET6VbwP0ehBv8aHzi1
MD5:	83C746741DAD17B26B2199C80758F5B4
SHA1:	90F6B84FD8A27139250D023C0B11C79179F74776
SHA-256:	87DB5D8585FED39E711843BC6AA8CC6C4BBDB7DA58A81D00D07DB9DEC1F33F53
SHA-512:	C1BC4474CF8F2F18CC67FA06C76684EC81AEFF122D14259A7EC3329843CE522CA996CEB7E1F485A1CC89EBDDDE58D09B9287A93D327B4688A89A48BFD3AE7DC4
Malicious:	false
Preview:	...@..@...@.....C.].....@................R...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".mudolg20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1B62E-2664.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03970575165561542
Encrypted:	false
SSDEEP:	192:7t0EbtmqvDtKX7CJEa3XxxTVwg7XhiV0DA5LshSVNQ+O1gQt11eaq01n8y08TcmQ:x0Et1eQtokhOtagO1vX108T2RGOD
MD5:	A895AF026C580C9D3C556F96181238D1
SHA1:	F16EE09FD74221BA604824B4970AFA60523261D8
SHA-256:	C3C849CEE9B1DB2B43163D4FF11FFD1CC8DA91B7EDD7583A155E76ACD171BF54
SHA-512:	6CF956575E599D746242D4C03A59778B0234D7AE5FEEC664737CA27A8FC1221B34975453764950DFCC63FC48B2B4C8ADAD27A3844C3F722CECC0DCCD270421E1
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mudolg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1B636-13EC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882511694364782
Encrypted:	false
SSDEEP:	192:/h0EbtmqvD3KX7RJEa3Xxx7UpXxgg6zfhj1NEx7GtM1gQMv8Ouiq2n8y08Tcm2Rl:J0EtYeZVQh52Wsgr84h08T2RGOD
MD5:	E7F808B3394958154D062EBA0C33C1A8
SHA1:	5E57A366448B87E932E4E7A775D2DAFDC3FB8BB7
SHA-256:	5B0860E84D25919EC6123ECEE2A23CB01BC2675DF1CD6958CADBF4DFFF9AF458
SHA-512:	599C2916E1D32F0F10336AB37AECF336C575E5532F9C23F8830257E0EE4A3335754B984E170F7EE4164992D488F0D405B67A3333CF2448B8E1E8DCE147DD9718
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mudolg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D1B643-1E90.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03881410772123439
Encrypted:	false
SSDEEP:	192:Nt0EbtmqvD3KX7dJEa3Xxx7UpXxgg6zfhj1NEx7wnu1gQMZBeZQoqln8y08Tcm2D:j0Et0eZVQh52a6gPejS08T2RGOD
MD5:	58A91C4222D9A0647BF21A07B5B3BB57
SHA1:	ED7D727533B42CA5361BFD47F0B4FE1033EA3D89
SHA-256:	DF1F5FA6019DE6FEA74B04E1642460BF910F710FD0E2911387D156646AE32E3F
SHA-512:	369180715EADCAA396BDCC82E0B2007D224FA120822132BE15F18DFB7EC771883842187AF778AD6B6223D58911EA57938396794E3FDAA96F997ACB6F545EBEDA
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mudolg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51358b19-3515-410b-83e5-1693f583cb39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7ab6151e-11da-45d1-adec-75b7cbf4e231.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558413528751664
Encrypted:	false
SSDEEP:	768:dTqFfw7pLGLvfKWPTPfwH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GXoArwSprtuI:dTqFf8cvfKWPTPfwHu1jaeuoxGtn
MD5:	36BFC1496869EF810402C1E1135EB3B3
SHA1:	6908410FB97F175D54C5F411D60ED0C68A5F5E11
SHA-256:	7ABC245653630EE8099CE6509E97068435E2AC8E499B92B6D4E31AC68367CDFE
SHA-512:	8D228B3242ACD355F0C8F33A38004B0119E04D7253F7D2AD074F9C800ADA644F74BCBA760F6C74F847D86ED6D8F95B258A8BD2FBFF8DDAAAEFFEFFF97CF5BE51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493286725664","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493286725664","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91223c22-1c9c-4467-a1cd-75eb605deeda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.566268115663495
Encrypted:	false
SSDEEP:	768:dTqFfw7pLGLvfKWPTPfTH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcvkGXoArwgprtQ:dTqFf8cvfKWPTPfTHu1jaNvkuoxQtQ
MD5:	10F03C1F1716EC42DE9C2CA65C8F2132
SHA1:	8A53AD17071B44DBA5C4D791A4417B09FDE24EED
SHA-256:	67AD35B34A0EEE2B8587C278811AB368D23B5DBADE77A6667C2FC669BD4B094D
SHA-512:	286C75BBEEEE2B4EFC3493346EF9F486F4EFE68325ABFCF3C16409391A39777877A2CCAB56315102ECDB92E347CFFA5499C882BABD42B19EC9000CF1995C38F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493286725664","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493286725664","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.319977625715814
Encrypted:	false
SSDEEP:	192:21AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:2uOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	0666FACDFB0CC1A1637624EEABF96E96
SHA1:	52F0AA58CCC5B4783D76EF02CB3F5B51D9E435C3
SHA-256:	F44D56726345CF317225556348629FDFE2CC086CB272C1036F6F2D9616840191
SHA-512:	CAA82EE9CBF684BA79D05B99CB01D9E068941E9C1E567618165833D904D39EAC5B817AD9497EA43FCC94898F2A96FFD43B5BE3A0B0E2B58FC52C963276EB04DF
Malicious:	false
Preview:	...m.................DB_VERSION.1?LE.................QUERY_TIMESTAMP:arbitration_priority_list4...13369493288941346.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.0680128357688625
Encrypted:	false
SSDEEP:	6:JIRQ4m81wkn23oH+Tcwt9Eh1ZB2KLlPq/M+q2Pwkn23oH+Tcwt9Eh1tIFUv:JIkfYeb9Eh1ZFLBq/M+vYfYeb9Eh16F2
MD5:	225EED64C87C77F5363505EB25D4215E
SHA1:	E974B1E43F59EE3CDE2A5CC89695A038EEE3AE75
SHA-256:	EF739F41EF6DCFAD8E6A5B72F9975D99BA198E8924E72EEDA0D7A8F691C2EE26
SHA-512:	6CF13812AB5CEFFEFC5CA0487B3B46D77F27B7EF49076DB01DF6B7D40E7AFE725EC18575771F834B53D83E136A79F5DE3DDC617499176A421CD4BCC171BBD104
Malicious:	false
Preview:	2024/08/30-08:08:08.145 226c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/30-08:08:08.223 226c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlceTt:Ls3Z
MD5:	B2C04547C1148DC4C1B33B3643B36896
SHA1:	0072B22BD8665DF9E1D4015EC163C2E4B2EE3A50
SHA-256:	3A401994593D54E7D066EAE6ACAF4CF2E108D4407ACD908C699AF8649AA87F88
SHA-512:	B7616D320BF8941A219ADCAD394AE252F6600F8E163B76549B1E5BD263D081FC23A3D20137ECDB35F8F82C565177587FED427A09BDB406B3809A865C908D044C
Malicious:	false
Preview:	..........................................4.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.155593990002054
Encrypted:	false
SSDEEP:	6:JV1wkn23oH+TcwtnG2tbB2KLlP+C31yq2Pwkn23oH+TcwtnG2tMsIFUv:JIfYebn9VFLBxIvYfYebn9GFUv
MD5:	79C48F9385471AFAD945691BF0D298DB
SHA1:	874E6EB3EFDE9CE9E750E2A4AF52868F638289B3
SHA-256:	A35DD6849F893AC4F93478725692CA014C11AAE3152E4DB7841D43776E374916
SHA-512:	C8F926A6AE7DF7B8B6926829BCC3854D61F737834537C9AEAA83BD32DEDFDB9CFC4EA0E930409405DE0B43EB8911A2AAD33E9BC8C9628C48B56A31491A11F713
Malicious:	false
Preview:	2024/08/30-08:08:06.790 23a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/30-08:08:07.283 23a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.136641861696339
Encrypted:	false
SSDEEP:	6:J+WwD1wkn23oH+Tcwt8aVdg2KLlPNq2Pwkn23oH+Tcwt8aPrqIFUv:J+PyfYeb0LBNvYfYebL3FUv
MD5:	135519EE682D8BBE2E1B681B657492EE
SHA1:	384C1A31D07DB96B420F03C40C155117A0BD79DE
SHA-256:	D86DFB5DA72CB6C1F3CEF0C16E607F409C6460D87DB3F186719E8FC5A56696B4
SHA-512:	61D384237E3D47852C55048E439BF6DC54297B0CB7A783E6A57BA589D8A8F12F5F03FF619A4029CEA9F7EFE0F160ACAE111B148D4682AB22F17910D0252A93EE
Malicious:	false
Preview:	2024/08/30-08:08:06.797 23e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/30-08:08:06.841 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.094904236988238
Encrypted:	false
SSDEEP:	6:J+mGQ1wkn23oH+Tcwt86FB2KLlP+XIq2Pwkn23oH+Tcwt865IFUv:J/KfYeb/FFLBsIvYfYeb/WFUv
MD5:	DCF0C3593E6DD075DF525136A6576D93
SHA1:	C95EE021AF36E31092B068E8C5C6A2DCC99BA339
SHA-256:	CBD8DB1A8CC238BB8106450FA76F8D5EC49135CCAB07351011AB8DB7C84FB981
SHA-512:	37214E33AC32F2397ECED875E272DA531032F3314D7B20B4A41F205982717B130D049E2F4DD1AC208618035FE23C02AD1B7130405BDDD4A6B3AC5DF554A7CC84
Malicious:	false
Preview:	2024/08/30-08:08:07.018 23e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/30-08:08:07.097 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.076285533060993
Encrypted:	false
SSDEEP:	6:J+UBOq2Pwkn23oH+Tcwt8NIFUt8S+UI/ZZmw+S+UI/zkwOwkn23oH+Tcwt8+eLJ:JIvYfYebpFUt8SM/Z/+SM/z5JfYebqJ
MD5:	EA55F5F3F730BCFDA4E4D194332BA53D
SHA1:	026374F98613DD77BEBE417AE04920A7B591B968
SHA-256:	8A5020B5282F40B803DE0FB5DF8632320C2FAD489ACFE1A6C1B7D7EEC658D181
SHA-512:	CDF9D204B2A0119A50F13FA0F22AE299B4A5F8E56750D62E45208EFFB0A2375BD6F35F51C26DFEFAFA18623CA74FD5E4F4F7B8C205D0B1E7035D9CCF4C38D11B
Malicious:	false
Preview:	2024/08/30-08:08:07.106 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/30-08:08:07.107 23e0 Recovering log #3.2024/08/30-08:08:07.107 23e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.076285533060993
Encrypted:	false
SSDEEP:	6:J+UBOq2Pwkn23oH+Tcwt8NIFUt8S+UI/ZZmw+S+UI/zkwOwkn23oH+Tcwt8+eLJ:JIvYfYebpFUt8SM/Z/+SM/z5JfYebqJ
MD5:	EA55F5F3F730BCFDA4E4D194332BA53D
SHA1:	026374F98613DD77BEBE417AE04920A7B591B968
SHA-256:	8A5020B5282F40B803DE0FB5DF8632320C2FAD489ACFE1A6C1B7D7EEC658D181
SHA-512:	CDF9D204B2A0119A50F13FA0F22AE299B4A5F8E56750D62E45208EFFB0A2375BD6F35F51C26DFEFAFA18623CA74FD5E4F4F7B8C205D0B1E7035D9CCF4C38D11B
Malicious:	false
Preview:	2024/08/30-08:08:07.106 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/30-08:08:07.107 23e0 Recovering log #3.2024/08/30-08:08:07.107 23e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3283577581710296
Encrypted:	false
SSDEEP:	6:uA/J3+t76Y4QZZofU99pO0BYdqR4EZY4QZvGB:PhHQws9LdFBQZGB
MD5:	3A312AD7145B3734BC7691D7E9BC8AF4
SHA1:	8BA018BD444CCCD2FA6E4898B27BCCEBB89F9175
SHA-256:	C50EE9146D159A09E16481E0B3830B61D235D9442B66F01824B105936A08E1D9
SHA-512:	583279424587C2ACFCF585C67A8669880486B24385615BD40C39481EA69E14C1DD63DD279296D2FE7482B9BE7C7778741C9957D990A6E51AD1DF75E0A57E0F3B
Malicious:	false
Preview:	............-......'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.2223150362603885
Encrypted:	false
SSDEEP:	12:JLvYfYeb8rcHEZrELFUt8Sr/+Sh5JfYeb8rcHEZrEZSJ:FYfYeb8nZrExg88JfYeb8nZrEZe
MD5:	3FE35576C66D79EFFE7A427DE8EC9DA8
SHA1:	1008E134D93D12F40E075310905F06CC7CC2E32E
SHA-256:	E14468624D3312D13FE1BE9196F423BED8D3A2249693D7B7C748492FB63AD2A0
SHA-512:	B06C5A6758030DA5894CB28543C19FABAEF2E6833C4B274B2BFE3C8287D7A68A86471D572528CAF18144EA8613E78F91AF2454E399FB7D73345EA5EF16A6D3C3
Malicious:	false
Preview:	2024/08/30-08:08:07.927 2370 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/30-08:08:07.928 2370 Recovering log #3.2024/08/30-08:08:07.928 2370 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.2223150362603885
Encrypted:	false
SSDEEP:	12:JLvYfYeb8rcHEZrELFUt8Sr/+Sh5JfYeb8rcHEZrEZSJ:FYfYeb8nZrExg88JfYeb8nZrEZe
MD5:	3FE35576C66D79EFFE7A427DE8EC9DA8
SHA1:	1008E134D93D12F40E075310905F06CC7CC2E32E
SHA-256:	E14468624D3312D13FE1BE9196F423BED8D3A2249693D7B7C748492FB63AD2A0
SHA-512:	B06C5A6758030DA5894CB28543C19FABAEF2E6833C4B274B2BFE3C8287D7A68A86471D572528CAF18144EA8613E78F91AF2454E399FB7D73345EA5EF16A6D3C3
Malicious:	false
Preview:	2024/08/30-08:08:07.927 2370 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/30-08:08:07.928 2370 Recovering log #3.2024/08/30-08:08:07.928 2370 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.168630869086927
Encrypted:	false
SSDEEP:	6:J+Q2SQ+q2Pwkn23oH+Tcwt8a2jMGIFUt8S+QLgZmw+S+RkQVkwOwkn23oH+Tcwtw:JOSVvYfYeb8EFUt8STg/+SokI5JfYebw
MD5:	43ECDBBA6D72304A6D6D623F23BBFF26
SHA1:	C2B20CC2EF357F709CB756E545AC24E3E91EB101
SHA-256:	ABF07003C44283A8773D023EE376E4348594A539E74930AF5E0F33227B8DCE3A
SHA-512:	3CF9B5FF224736BC542B50BD2CFC3D793993F45DDBE54C51B2DCFB97612BDE006C81E990F3ED708EE01BA7128507412322639170CB367FDA3B2E2463F77AA7AF
Malicious:	false
Preview:	2024/08/30-08:08:07.548 12f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/30-08:08:07.559 12f8 Recovering log #3.2024/08/30-08:08:07.654 12f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.168630869086927
Encrypted:	false
SSDEEP:	6:J+Q2SQ+q2Pwkn23oH+Tcwt8a2jMGIFUt8S+QLgZmw+S+RkQVkwOwkn23oH+Tcwtw:JOSVvYfYeb8EFUt8STg/+SokI5JfYebw
MD5:	43ECDBBA6D72304A6D6D623F23BBFF26
SHA1:	C2B20CC2EF357F709CB756E545AC24E3E91EB101
SHA-256:	ABF07003C44283A8773D023EE376E4348594A539E74930AF5E0F33227B8DCE3A
SHA-512:	3CF9B5FF224736BC542B50BD2CFC3D793993F45DDBE54C51B2DCFB97612BDE006C81E990F3ED708EE01BA7128507412322639170CB367FDA3B2E2463F77AA7AF
Malicious:	false
Preview:	2024/08/30-08:08:07.548 12f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/30-08:08:07.559 12f8 Recovering log #3.2024/08/30-08:08:07.654 12f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b340b1e-d785-4a6d-b4ed-68f7e98c4598.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\625a6176-a611-43f1-9516-9ef38e57bf2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e2cf018-0b10-4940-b549-76e7f465ec36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2e526.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3d2a3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2be64.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2cd68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2e526.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\abed0587-722f-4d97-943a-967c47678878.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b626085e-6609-4493-a0af-561203b6880b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d59e898f-5fd1-464c-bc94-6dca478f01c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\eec795e9-c888-42cd-92b5-fcb8ba7191a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.300603760888116
Encrypted:	false
SSDEEP:	24:YXsKbZVMdBspZFRudFGcsXFZFGJ/dbG7nby:YXsE8sffcdsDgzbZ
MD5:	8515420ECBFA556418B0E002211665C6
SHA1:	0889FC5B01D694A6F5129F3558EE2D3F3FEEBAEF
SHA-256:	09AB12B65B1DDDBEAEE8B2E20F94C0017A0D717009ED2CD1AB0421E696027311
SHA-512:	E55AF3C38B20075DBB74BF4EDA9579F2BDE4CD54A09C7774C0907D55564013AC07A38B7310630B8A476988F07B56E365F3DBE6DA72083DB55F1AF515FCA613B0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372085288882063","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372085289880867","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372085293040088","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072333129500257
Encrypted:	false
SSDEEP:	96:sVfWqlYTJ1Pb9hbGO08XzFHJY4sY5Th6Cp9/x+6M8muecmAeCDe4zvrX2X6gE5Ak:sVOFJ9/08DNJY4sYPpj+FVAfXFBf
MD5:	73C1A05B7B0D786572EA1A1E4800C28B
SHA1:	B924B830C838FC8696152E8F796CFC811E157EC2
SHA-256:	4B777D91C7CBD21175E59F838D664C860D3A14D29BE5FE25D295F880C15C0ACB
SHA-512:	FE80A9F8FEAD0B19A7DAEF854E7E075C90EFDAC2092ACE06CCBD6DE4EAFD988415AE33E0E91CF4F63E43FC954A76E564859169BBD6DD6E8EAAF80A5D3D058EC4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369493286970026","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33922.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072333129500257
Encrypted:	false
SSDEEP:	96:sVfWqlYTJ1Pb9hbGO08XzFHJY4sY5Th6Cp9/x+6M8muecmAeCDe4zvrX2X6gE5Ak:sVOFJ9/08DNJY4sYPpj+FVAfXFBf
MD5:	73C1A05B7B0D786572EA1A1E4800C28B
SHA1:	B924B830C838FC8696152E8F796CFC811E157EC2
SHA-256:	4B777D91C7CBD21175E59F838D664C860D3A14D29BE5FE25D295F880C15C0ACB
SHA-512:	FE80A9F8FEAD0B19A7DAEF854E7E075C90EFDAC2092ACE06CCBD6DE4EAFD988415AE33E0E91CF4F63E43FC954A76E564859169BBD6DD6E8EAAF80A5D3D058EC4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369493286970026","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ca46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072333129500257
Encrypted:	false
SSDEEP:	96:sVfWqlYTJ1Pb9hbGO08XzFHJY4sY5Th6Cp9/x+6M8muecmAeCDe4zvrX2X6gE5Ak:sVOFJ9/08DNJY4sYPpj+FVAfXFBf
MD5:	73C1A05B7B0D786572EA1A1E4800C28B
SHA1:	B924B830C838FC8696152E8F796CFC811E157EC2
SHA-256:	4B777D91C7CBD21175E59F838D664C860D3A14D29BE5FE25D295F880C15C0ACB
SHA-512:	FE80A9F8FEAD0B19A7DAEF854E7E075C90EFDAC2092ACE06CCBD6DE4EAFD988415AE33E0E91CF4F63E43FC954A76E564859169BBD6DD6E8EAAF80A5D3D058EC4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369493286970026","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558413528751664
Encrypted:	false
SSDEEP:	768:dTqFfw7pLGLvfKWPTPfwH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GXoArwSprtuI:dTqFf8cvfKWPTPfwHu1jaeuoxGtn
MD5:	36BFC1496869EF810402C1E1135EB3B3
SHA1:	6908410FB97F175D54C5F411D60ED0C68A5F5E11
SHA-256:	7ABC245653630EE8099CE6509E97068435E2AC8E499B92B6D4E31AC68367CDFE
SHA-512:	8D228B3242ACD355F0C8F33A38004B0119E04D7253F7D2AD074F9C800ADA644F74BCBA760F6C74F847D86ED6D8F95B258A8BD2FBFF8DDAAAEFFEFFF97CF5BE51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493286725664","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493286725664","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF31ef3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558413528751664
Encrypted:	false
SSDEEP:	768:dTqFfw7pLGLvfKWPTPfwH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GXoArwSprtuI:dTqFf8cvfKWPTPfwHu1jaeuoxGtn
MD5:	36BFC1496869EF810402C1E1135EB3B3
SHA1:	6908410FB97F175D54C5F411D60ED0C68A5F5E11
SHA-256:	7ABC245653630EE8099CE6509E97068435E2AC8E499B92B6D4E31AC68367CDFE
SHA-512:	8D228B3242ACD355F0C8F33A38004B0119E04D7253F7D2AD074F9C800ADA644F74BCBA760F6C74F847D86ED6D8F95B258A8BD2FBFF8DDAAAEFFEFFF97CF5BE51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369493286725664","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369493286725664","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.076719314307805
Encrypted:	false
SSDEEP:	6:J2uQQ+q2Pwkn23oH+TcwtrQMxIFUt8S1sQgZmw+S2kQVkwOwkn23oH+TcwtrQMFd:J2uQVvYfYebCFUt8S+Qg/+SXI5JfYebf
MD5:	DCED17775019635779C2904BC8473FC4
SHA1:	C85FC58DB373C741BC4143A8CBB5BEC5E6C215A6
SHA-256:	2E96284349A8D07E0DEB96D273FA0C0D036325568402E46A65A229DA021B55A1
SHA-512:	764A0712319B1630DA91F52B5243E5952DF306852969EB5F5041BAF92380CBD164A5B72FD000B33F2E3EFF3E75A1DD1D4D05D4743956DE3E7A9B5364DBA94D0F
Malicious:	false
Preview:	2024/08/30-08:08:22.836 12f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/30-08:08:22.837 12f8 Recovering log #3.2024/08/30-08:08:22.840 12f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.076719314307805
Encrypted:	false
SSDEEP:	6:J2uQQ+q2Pwkn23oH+TcwtrQMxIFUt8S1sQgZmw+S2kQVkwOwkn23oH+TcwtrQMFd:J2uQVvYfYebCFUt8S+Qg/+SXI5JfYebf
MD5:	DCED17775019635779C2904BC8473FC4
SHA1:	C85FC58DB373C741BC4143A8CBB5BEC5E6C215A6
SHA-256:	2E96284349A8D07E0DEB96D273FA0C0D036325568402E46A65A229DA021B55A1
SHA-512:	764A0712319B1630DA91F52B5243E5952DF306852969EB5F5041BAF92380CBD164A5B72FD000B33F2E3EFF3E75A1DD1D4D05D4743956DE3E7A9B5364DBA94D0F
Malicious:	false
Preview:	2024/08/30-08:08:22.836 12f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/30-08:08:22.837 12f8 Recovering log #3.2024/08/30-08:08:22.840 12f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0866976808611275
Encrypted:	false
SSDEEP:	6:J1eOq2Pwkn23oH+Tcwt7Uh2ghZIFUt8SSWnZmw+SSW1kwOwkn23oH+Tcwt7Uh2gd:J1eOvYfYebIhHh2FUt8SB/+Sb5JfYebs
MD5:	FA02551E41A6437859000B507B57CAE5
SHA1:	48C8CA893D34205269F1AD7367F35F3A574D336E
SHA-256:	4D8260F93051622CFDEA4AFF9C6C79F77ADA74914520506661C4D3E2644C66A2
SHA-512:	769A99B959AD65DDEAB884E4D50E201F230CD4FF216EFFDDE446CE86EB7C4440B25B602B1BCEF4E2E919D4CAB1784ECF49008832833FA683050F567BB99A5B83
Malicious:	false
Preview:	2024/08/30-08:08:06.857 2380 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/30-08:08:06.858 2380 Recovering log #3.2024/08/30-08:08:06.858 2380 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0866976808611275
Encrypted:	false
SSDEEP:	6:J1eOq2Pwkn23oH+Tcwt7Uh2ghZIFUt8SSWnZmw+SSW1kwOwkn23oH+Tcwt7Uh2gd:J1eOvYfYebIhHh2FUt8SB/+Sb5JfYebs
MD5:	FA02551E41A6437859000B507B57CAE5
SHA1:	48C8CA893D34205269F1AD7367F35F3A574D336E
SHA-256:	4D8260F93051622CFDEA4AFF9C6C79F77ADA74914520506661C4D3E2644C66A2
SHA-512:	769A99B959AD65DDEAB884E4D50E201F230CD4FF216EFFDDE446CE86EB7C4440B25B602B1BCEF4E2E919D4CAB1784ECF49008832833FA683050F567BB99A5B83
Malicious:	false
Preview:	2024/08/30-08:08:06.857 2380 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/30-08:08:06.858 2380 Recovering log #3.2024/08/30-08:08:06.858 2380 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulPBlt:Ls6lt
MD5:	5BC68985936673CC3065444B97DF03B3
SHA1:	0E85E598E941AB10CA703F09CED4F27CB9673908
SHA-256:	59EECD7878EA6D5691D385404C788D2FBCC25B3D2044FB7D918DD73E6B7A6398
SHA-512:	2F3A3A4714C53E4C442B39EF1F7F62E0C8B28CBA0CE6BF76BFDE971E07F0968DA0A361F818618005DD2EE8940C1D753F9DE935E077952B48727552B7155174E2
Malicious:	false
Preview:	........................................y...{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlksw/:Ls3kh/
MD5:	D8BB2CC3710C68524154911C13FC7BD8
SHA1:	D1819681DEC92CDF0FF6A8A5F44510AA21B6C46F
SHA-256:	3199586344CD347D7A3E520D94A0DE408719FB5BDCDA093E65C208101676CEE3
SHA-512:	07E984D0DF04F37CA653D4E589504DCEDCF6384421F3C8C0162192C66A5B518634FBAFF187260CABF84546F3D85CD18C6FFAA2CC119E24EA05621B7BB51D9821
Malicious:	false
Preview:	..........................................7.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.25066365472789
Encrypted:	false
SSDEEP:	12:JnMvYfYebvqBQFUt8S/6/+S25JfYebvqBvJ:Z2YfYebvZg8azJfYebvk
MD5:	ED52E2839DC08462FD537EB590F11686
SHA1:	7C968ABCECF959C2A3171B5350849C6CF8188367
SHA-256:	E96CCED70A32B0A73BEAF5EA44AB7906F11D1748DF7F7F0DE9456C8BE8A84676
SHA-512:	ED91CA27DECA7CD500F13E586A7DA0149DD7693E79046C37C174EA80AEEAF126A08FD77B03BF9598020B3D38A74DFB43935945D531A172076B701D33179EED95
Malicious:	false
Preview:	2024/08/30-08:08:07.660 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/30-08:08:07.661 15c8 Recovering log #3.2024/08/30-08:08:07.669 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.25066365472789
Encrypted:	false
SSDEEP:	12:JnMvYfYebvqBQFUt8S/6/+S25JfYebvqBvJ:Z2YfYebvZg8azJfYebvk
MD5:	ED52E2839DC08462FD537EB590F11686
SHA1:	7C968ABCECF959C2A3171B5350849C6CF8188367
SHA-256:	E96CCED70A32B0A73BEAF5EA44AB7906F11D1748DF7F7F0DE9456C8BE8A84676
SHA-512:	ED91CA27DECA7CD500F13E586A7DA0149DD7693E79046C37C174EA80AEEAF126A08FD77B03BF9598020B3D38A74DFB43935945D531A172076B701D33179EED95
Malicious:	false
Preview:	2024/08/30-08:08:07.660 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/30-08:08:07.661 15c8 Recovering log #3.2024/08/30-08:08:07.669 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0cb1bd6d-dd0d-4e26-b684-b2203dce0686.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\69ba8893-8adc-4246-a612-49b03e0ce580.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3e30e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2cd77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e070a24f-c43e-493e-8939-be5a28660613.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f311149f-7a4a-4af5-9c2f-7a35b0954ec3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.21504287644992
Encrypted:	false
SSDEEP:	12:JxQVvYfYebvqBZFUt8SZg/+ShYkI5JfYebvqBaJ:mYfYebvyg8AJfYebvL
MD5:	30A8A54BD2B14A4C54F55A737F3876CB
SHA1:	10981964E1D03A13A794AFA63095707BEACFFCBE
SHA-256:	2D152150A19A12A22D942D9313BCB1F68DCB28619BABFEF5934E82BD3C2E5336
SHA-512:	4A39CF0598CD76DBFF82952F1B02A08C13A12F10EC3F06D0F1F13EBCA5CCED7B4BAC34D1D4DB5C2D3A3D9C2B3CA9BD49D91722A37338066D5011433888B8FED7
Malicious:	false
Preview:	2024/08/30-08:08:22.917 12f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/30-08:08:22.918 12f8 Recovering log #3.2024/08/30-08:08:22.927 12f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.21504287644992
Encrypted:	false
SSDEEP:	12:JxQVvYfYebvqBZFUt8SZg/+ShYkI5JfYebvqBaJ:mYfYebvyg8AJfYebvL
MD5:	30A8A54BD2B14A4C54F55A737F3876CB
SHA1:	10981964E1D03A13A794AFA63095707BEACFFCBE
SHA-256:	2D152150A19A12A22D942D9313BCB1F68DCB28619BABFEF5934E82BD3C2E5336
SHA-512:	4A39CF0598CD76DBFF82952F1B02A08C13A12F10EC3F06D0F1F13EBCA5CCED7B4BAC34D1D4DB5C2D3A3D9C2B3CA9BD49D91722A37338066D5011433888B8FED7
Malicious:	false
Preview:	2024/08/30-08:08:22.917 12f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/30-08:08:22.918 12f8 Recovering log #3.2024/08/30-08:08:22.927 12f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.147708407976324
Encrypted:	false
SSDEEP:	6:JIHvIq2Pwkn23oH+TcwtpIFUt8SvZmw+S9kwOwkn23oH+Tcwta/WLJ:J6vIvYfYebmFUt8Sv/+S95JfYebaUJ
MD5:	AA6474CF4F8C2F44695A6FF51D3BA7AD
SHA1:	22CB872394349BB01E58E67C717A0F0D6780208E
SHA-256:	E2EAF117D5BA65FE8DB273D5BDD547E1E7ABF416CD126A55D56A5DBB284F78A0
SHA-512:	D363D9CFF4EB0AFC0DA75F5D6BFA70A00BFFF7984BAC320FF8A980B87642534099D12A54B10B0FF0230104CFEAF5E3B50CAB07F1A24CC8E8CDDEDE87F4341120
Malicious:	false
Preview:	2024/08/30-08:08:06.848 23b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/30-08:08:06.850 23b0 Recovering log #3.2024/08/30-08:08:06.850 23b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.147708407976324
Encrypted:	false
SSDEEP:	6:JIHvIq2Pwkn23oH+TcwtpIFUt8SvZmw+S9kwOwkn23oH+Tcwta/WLJ:J6vIvYfYebmFUt8Sv/+S95JfYebaUJ
MD5:	AA6474CF4F8C2F44695A6FF51D3BA7AD
SHA1:	22CB872394349BB01E58E67C717A0F0D6780208E
SHA-256:	E2EAF117D5BA65FE8DB273D5BDD547E1E7ABF416CD126A55D56A5DBB284F78A0
SHA-512:	D363D9CFF4EB0AFC0DA75F5D6BFA70A00BFFF7984BAC320FF8A980B87642534099D12A54B10B0FF0230104CFEAF5E3B50CAB07F1A24CC8E8CDDEDE87F4341120
Malicious:	false
Preview:	2024/08/30-08:08:06.848 23b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/30-08:08:06.850 23b0 Recovering log #3.2024/08/30-08:08:06.850 23b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:QEl1lhtlK:QE36
MD5:	91F41E8942E3FCE301C10A729814A952
SHA1:	BE315D3E5648AE89E5F5C4DC254845DD3347F69A
SHA-256:	4049EA67A9401A9DCC0A3BFDAA922C57343C7B73C53D9C8BFAB5FF84F2FD74FE
SHA-512:	E7ADF208CE2AD066400FA45B15B7C78F0D8415D5CFB9FE3413EB027E5A615634FE591FB5AC4C50242B561C56A3351182476A1817432AF6E33CF60B8266CFC627
Malicious:	false
Preview:	............2`(....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a5867fb0-4288-4d62-bd9d-9d70ab77cc05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9294
Entropy (8bit):	5.187421566779543
Encrypted:	false
SSDEEP:	96:sVfWqlYTJ1Pb9hbGO08XzFHXGRP0sY4sY5Th6Cp9/x+6M8muecmAeCKAe4zvrX24:sVOFJ9/08DNWFY4sYPpj+FVAbXFBf
MD5:	18A7E2AC83E1ADFE4077A16AD8A99E8B
SHA1:	5F11DB654D96915466A19A2B1E9CBE303618F51F
SHA-256:	98EB38D10DF21A90DD76A6A247AFF5EF63363DC9663D063637A0CF7ACB897255
SHA-512:	E8C1B6DF3A23E852133DF37D88466DCF74D7BD5A1118AC6B063EA0F79CB466D7E02DFFA3A0078F5883CD692B2C64341F227F3AE1E0DEAA260E5E2BD3A5EB8828
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369493286970026","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a9a9e7d1-bef1-4352-a407-77a552ddcd96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	5.18628376267888
Encrypted:	false
SSDEEP:	96:sVfWqlYTJ1Pb9hbGO08XzFHXGRP0sY4sY5Th6Cp9/x+6M8muecmAeCZAe4zvrX24:sVOFJ9/08DNWFY4sYPpj+FVAoXFBf
MD5:	9B8E3B4FB7F7F965155891C3D251B6BF
SHA1:	F80B08EE06048B96D6A5C73DC42CA090A868CC7D
SHA-256:	03F2D40644D122DB17DF0A9FCF28643489D5464F108859CB8FDB8D2C71A6B548
SHA-512:	5B5AA231E2BCA489B152CE9F28357D6AD2BFED3349CE10D1F82494A85AB9461DB49FACD57464AA893F75C0D9824E288340A9C212CA2665F7C92D8E3CBBCA894C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369493286970026","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b6d8a400-3c90-4a54-b9e3-592216f574c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072333129500257
Encrypted:	false
SSDEEP:	96:sVfWqlYTJ1Pb9hbGO08XzFHJY4sY5Th6Cp9/x+6M8muecmAeCDe4zvrX2X6gE5Ak:sVOFJ9/08DNJY4sYPpj+FVAfXFBf
MD5:	73C1A05B7B0D786572EA1A1E4800C28B
SHA1:	B924B830C838FC8696152E8F796CFC811E157EC2
SHA-256:	4B777D91C7CBD21175E59F838D664C860D3A14D29BE5FE25D295F880C15C0ACB
SHA-512:	FE80A9F8FEAD0B19A7DAEF854E7E075C90EFDAC2092ACE06CCBD6DE4EAFD988415AE33E0E91CF4F63E43FC954A76E564859169BBD6DD6E8EAAF80A5D3D058EC4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369493286970026","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ff4b0aec-d250-46d0-b4f0-d8506403b09a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.251522713946152
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxljl1l9/l3seGKT9rcQ6xRU:/XntM+4ljl1lFl3sedhOy
MD5:	209C66FB518206C0C153B4359372E212
SHA1:	D64C4C5139CF20E64EF6274F51CF5D1CCBD2CECE
SHA-256:	2D64D96F17649EBC793A04215E5E2331315E59BFFDF27BCD519DF540585CDEDA
SHA-512:	52020E518EF3DEB1F7FC862C5CC4578D27C2E8E26657FE428B92DC67C95B39959D2783C15BD5FDC7ED9FEC36BBE8838B000B0E0C617D5C00DC6B034C79A71346
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f................8MQ0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.201846215931425
Encrypted:	false
SSDEEP:	6:J+TG6RRM1wkn23oH+Tcwtfrl2KLlP+UAFq2Pwkn23oH+TcwtfrK+IFUv:JyRRrfYeb1LB8FvYfYeb23FUv
MD5:	B986A04B108A9FB6E301E4612E044A44
SHA1:	248C11197A01CA1C68FFE92645102CBAA0363509
SHA-256:	D17254C9E927ADE917620BBF20ED1C28C9598FD924250E190D3956A59130AEDC
SHA-512:	DE273D21061ABF604C50DF863A0547BEA7177CCE7A279055A0FB79CDD843056C7998654D19F54876C0A7D4CE57AEFD839EB689DC775319F46A058C20E8ADED4E
Malicious:	false
Preview:	2024/08/30-08:08:07.084 23b4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/30-08:08:07.152 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	646
Entropy (8bit):	3.9481045424728007
Encrypted:	false
SSDEEP:	12:G0nYUtTNVdZ5ML/ZCbhCi/zulTbiBs/zzBstXw:G0nYUtP35O/ZWhHbqTwtg
MD5:	90384043ACF97346D04ACF722025E28A
SHA1:	30DBCEA4C0BF1199740B2B45FF0CE4BC816BD1A2
SHA-256:	6336651FA90A8D41F12947DDC76EC01B67C072CAF4C89D8CDD275EF9966F153F
SHA-512:	1A4615FE3344519A59EF4D973C8035D7F48BEE26BC0D03A05090E54A992595BD84B09527E51258254E308D251C2922D86BB45A83C3C15F6EBDD429CABD46FB20
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_.....T....................20_......Q...................20_..........................19_........4.................18_......[s..................21_.....%.{..................9_.....f..U.................9_.......6..................21_......}...................37_........................38_.......h..................39_.....R....................37_......%d..................38_.......K..................39_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.170963899151325
Encrypted:	false
SSDEEP:	6:JK3RRM1wkn23oH+Tcwtfrzs52KLlP+kORFIq2Pwkn23oH+TcwtfrzAdIFUv:JQRRrfYebs9LBjOMvYfYeb9FUv
MD5:	3E3E893CC56D59ADEB553936AE0F625E
SHA1:	1A9005889888A86A1E81744813BEB5FF65A10F98
SHA-256:	6291EC2E0E8E4DE24652917E154CAFA445BC593D0DFCCF95C417288A0C6C5424
SHA-512:	0F45F91A22A27DCD4CBD30473E40C251E4586E98F32634F6C460EC13A1077AE6D31BCFF9E285C84DE93AD1330703733B1A68152ACE2CF5587D540E0688C0F62C
Malicious:	false
Preview:	2024/08/30-08:08:06.894 23b4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/30-08:08:07.081 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlM9+l/:Ls3M9+l/
MD5:	21D33B0A8E20C690A0782E6AA9FD2A1E
SHA1:	F291A585E1B65C72B2CEA1AEAF368B1A6C21C3EB
SHA-256:	DDB3027F1D9E4362637246209BB471D83E93A6F852DA68D48B60AB91E0F40AF0
SHA-512:	DB5ACDDBE2448C0A697AF2887A27C1373C06E51C66D99732C7BFB4B235193E6A747B5ECFA687DC84FF4BFE36999B16FB936E5C44AEC9172AE57C19396E765656
Malicious:	false
Preview:	.........................................,A.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYFa/:Ls3YFa/
MD5:	7B5F063A5E9DABCD74290C8A96B2F0C4
SHA1:	EFC8863B51D91C971E2331ABF4A9F06E826C3D49
SHA-256:	7F0397D4513B4D107B468BDCBD5F8ED6519F8A590D4031368406DC25C7510CB5
SHA-512:	716D74C57E6772B56A4F9E2CF98BD8D2351F5CCACAE62FE0B042FE4E1B240DD443750C57E7FF38212123D08A5C0C94D4CC1C7EB8F5C9FC453DFDEE1A80411AEB
Malicious:	false
Preview:	........................................b.A.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b9d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b9e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d874.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d8c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d910.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f850.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32b86.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32ba5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a2f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ca17.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41960.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlBwX:Ls3K
MD5:	2E188A0EA7A9FED46E20DA2CB58FEF09
SHA1:	CA259DE6D904FCEBFBAA7B4B169B697B42EF7BEF
SHA-256:	29385AE273782C31128B011C209CC048F6AE96986E4C0EA99E81D08A3CAA12C0
SHA-512:	2C0895CCE8D83AE02C5B8F4EF4C347D9C1B08EDC3570CDA830320AF47A7A491BA23C79EAF709CF8B5051F6B05A3AB12E700AD40CABB01E5215D6A42B64259226
Malicious:	false
Preview:	..........................................-.{./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a225d7d0-2ed5-4a98-94d2-6f77cc4aa4f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9448
Entropy (8bit):	5.832460139397103
Encrypted:	false
SSDEEP:	192:fsNw60KeiRUkN1hQ5J1Hlktl96qRAq1k8SPxVLZ7VTiB:fsNwxQdbK5rH2tl96q3QxVNZTiB
MD5:	DCDE9FF08706D910C568EFDF3A457E6A
SHA1:	6597337B4E9FCE4935C8E361960CBD9C6448D81B
SHA-256:	98F553498A053ECD229A0E39D95A70FC8217DB77E2BA574EE73A3A20262121C7
SHA-512:	F3D6E64A9E8BDD03855D9212972D35708AD074E4FCB1C75755657EF04D0A7BE40491A1BE8580C815528F8BB3222DFCABCB0B921DFB56FA5F3E71A71FEBC4B66F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bacc4b6c-edcc-4cd7-9943-dab345f5e0fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60088
Entropy (8bit):	6.08137990303767
Encrypted:	false
SSDEEP:	1536:xMGQ5XMBGU0af8dP0SwkuoM1CBeOq+L7/ZGizJH:xMrJM8KkdP0SnuuB99GizJH
MD5:	AC89B254E8E60B6AD4314351C944EBED
SHA1:	D7148D561682403CDC795F512C12794F6F476041
SHA-256:	998D28EC4C058250612376F279F5D0B8B9093E5EF994FCBBE5AA325D63659A6F
SHA-512:	A36A7B57B86B0052D18E03C86BEAF606AE7345D4C93A35EE7904FC58BDA273CA360F7AF2A44A8F616B9B07FBE2221BC60C2DF7FDEE7242CA66E1EB1A3152937B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493286936445","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cb68e048-befe-4c90-9d6e-6e28d3c72052.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791309573194547
Encrypted:	false
SSDEEP:	96:iaqkHfiWhp5ih/cI9URLl8RotolMFVvlwhQMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:ak602eiRUuhQ86qRAq1k8SPxVLZ7VTiq
MD5:	A8E20D50908E3817D3D8E2DC0A1C6B1E
SHA1:	82FD4569D364C5DD5179C40F1C28CDADB0BFEE1D
SHA-256:	16735A766BBF4E808601CBF6E85CF234396A39EB8E04E375AECEB5E3D16448E5
SHA-512:	21CAF32E7AF2CB7B62C592A4B99298A5FED9CB71E6A5E059A164C5E3D283CFD6C4CF92376AEA3A76EC3A38855BF88BE84EF7E4AE9FA09997BC9A6716F64565A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnogHRI5RtSp/dCGwwnumOEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADf9tU8s6G8Vd0FKhb3qnS7DhZAPGEseprRNO78RxHNbQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ce181273-eee7-4e5e-9e5c-e7d2d1a0fb88.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24722
Entropy (8bit):	6.052347194342591
Encrypted:	false
SSDEEP:	768:xMGQ7FCYXGIgtDAWtJ4n8m12QGiz3ah02td/:xMGQ5XMBGDHGizmH
MD5:	C51635C778F3ACB4B0C24FAEB96F267F
SHA1:	7B3CC715A314BEA6E27D1E8ABA2211A4D79BA7ED
SHA-256:	590A8243BE4FF65C7ADEB008BF43A12D5C3692B32A5EBC1EED253A38F29CD530
SHA-512:	DCF10FEB964A6C4E7904615D9912AE995964758952FB1E7DEAE4F24CC130908CB7B08349E574507192C08E4457BAE9E40355F7D13922C4EE664111BDAAC99278
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493286936445","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e66e2cec-a188-49ec-b4a6-6eeb6f67103a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058488387499305
Encrypted:	false
SSDEEP:	384:7tMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwimx3tQ2ts+Mh0lkdHd5q8:xMGQ7FCYXGIgtDAWtJ4nGm1tQ2tMh02H
MD5:	B96AB1FC6B5417F621BD259EACC650EE
SHA1:	3654375E52ED12566214D1873367BF13A093799B
SHA-256:	88E55FA86A5A38B808CAAC569538D42E9670E62F6D9B9C0FC1827B9B80F83EA5
SHA-512:	B2B603639426ECEDA3EFDC0ECF1BD317F87A210249A16CE9AAA92AA35102C69E1C7AD233E8962CDCFF4F09A0C66C002F5FFA8F9935C8AC8572C1318D531F5462
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369493286936445","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8395321276115437
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxwIxl9Il8uxe34l0ZMs+VDj9TpattKNd1rc:mAY3Q4l0ZMNDAXKW
MD5:	E91C6BC67BC1889697E4DB42B5C64950
SHA1:	54CF664506286183EF885FF4336C4B411E3E6207
SHA-256:	3AB1DA6A3D325D63AC4A6D205CE2DF458ECF9F19389DB511147284B05A0E06F1
SHA-512:	6B925DF2EFE734CBF333742E110D8E445D30F387ADA95E43E7B084365C337E0577F1A2D828E4E372CA7D0EA31F7CFB2830D9D7208E5A6A677068EAF7AF4C638C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.e.Z.o.N.3.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.6.I.B.0.S.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.00768719952349
Encrypted:	false
SSDEEP:	96:rY3UGnnUCZ2hVXzapZsISAxYm6yK1q0Sv:riUGUCZIXuZSOK1q0Sv
MD5:	CFA8A3B2F9020F27F81919FACA2B51E2
SHA1:	D61092CD51FE4ED0B064770D7A7F7EBEF92D3669
SHA-256:	D191AE335D670D9958D7E16BAFDD505371F832F308B6EAEA83D216288236E7DB
SHA-512:	C6FE2A327A61DDCC50A2DD0C8BED5A1724CD9B4A0E90B1CD4725D9C4EDF9E40EF35EB46C2C7A09408062906D4610FCD34204AEE86C333C1EB19A38EDB24F39D8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".a.X.D.F.h.t.X.6.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.6.I.B.0.S.

C:\Users\user\AppData\Local\Temp\09035530-8fd0-4381-a337-57e468a3f155.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\382d109f-5e9a-4f97-a956-fd92a2ad3d1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\b441a7ac-59fa-4bbc-839d-ae611f982647.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c223ff56-8aca-43b9-8f87-e93f618a5328.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping1404_423784784\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.87107305218322
Encrypted:	false
SSDEEP:	3:SddQLtQSnUunhU1mWrO2V:S/QZHThyay
MD5:	0C9218609241DBAA26EBA66D5AAF08AB
SHA1:	31F1437C07241E5F075268212C11A566CEB514EC
SHA-256:	52493422AC4C18918DC91EF5C4D0E50C130EA3AA99915FA542B890A79EA94F2B
SHA-512:	5D25A1FB8D9E902647673975F13D7CA11E1F00F3C19449973D6B466D333198768E777B8CAE5BECEF5C66C9A0C0EF320A65116B5070C66E3B9844461BB0FFA47F
Malicious:	false
Preview:	1.8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping1404_423784784\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.405914533496662
Encrypted:	false
SSDEEP:	3:3FFhAWAUNhRKpEbXKS2XAXMWxQHJCzhiFfASvAcWxQHJCr2SkhSA:3FFWeRl2QIpCU4SvrpCSSkhSA
MD5:	58D3CA1189DF439D0538A75912496BCF
SHA1:	99AF5B6A006A6929CC08744D1B54E3623FEC2F36
SHA-256:	A946DB31A6A985BDB64EA9F403294B479571CA3C22215742BDC26EA1CF123437
SHA-512:	AFD7F140E89472D4827156EC1C48DA488B0D06DAAA737351C7BEC6BC12EDFC4443460C4AC169287350934CA66FB2F883347ED8084C62CAF9F883A736243194A2
Malicious:	false
Preview:	{.. "description" : "AutoLaunch Protocols Preregistration",.. "name" : "Protocol Preregistration",.. "version" : "1.0.0.8"..}

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping1404_423784784\protocols.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	4.532278538438865
Encrypted:	false
SSDEEP:	48:O//uidcRcrcNc0cTc8cs+PcrcNc0cTc8csLcrcNc0cTc8cstcrcNc0cTc8csH:O//uWJ2UH
MD5:	6BBB18BB210B0AF189F5D76A65F7AD80
SHA1:	87B804075E78AF64293611A637504273FADFE718
SHA-256:	01594D510A1BBC016897EC89402553ECA423DFDC8B82BAFBC5653BF0C976F57C
SHA-512:	4788EDCFA3911C3BB2BE8FC447166C330E8AC389F74E8C44E13238EAD2FA45C8538AEE325BD0D1CC40D91AD47DEA1AA94A92148A62983144FDECFF2130EE120D
Malicious:	false
Preview:	{.. "allow": [.. {.. "origins": [.. "https://.get.microsoft.com",.. "https://.apps.microsoft.com".. ],.. "protocol": "ms-windows-store".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.live.com",.. "https://sharepoint.com".. ],.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://[a-z1-9-]word-edit.officeapps.live.com",.. "https://[a-z1-9-]word-view.officeapps.live.com",.. "https://[a-z1-9-]onenote.officeapps.live.com",.. "https://[a-z1-9-]eap.officeapps.live.com",.. "https://[a-z1-9-]shared.officeapps.live.com",.. "https://[a-z1-9-]afhs.officeapps.live.com",.. "https://[a-z1-9-]vhs.officeapps.live.com",.. "https://[a-z1-9-]optin.online.office.com".. ],.. "use_regex": true,.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.li

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8968_1934143332\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.87107305218322
Encrypted:	false
SSDEEP:	3:SddQLtQSnUunhU1mWrO2V:S/QZHThyay
MD5:	0C9218609241DBAA26EBA66D5AAF08AB
SHA1:	31F1437C07241E5F075268212C11A566CEB514EC
SHA-256:	52493422AC4C18918DC91EF5C4D0E50C130EA3AA99915FA542B890A79EA94F2B
SHA-512:	5D25A1FB8D9E902647673975F13D7CA11E1F00F3C19449973D6B466D333198768E777B8CAE5BECEF5C66C9A0C0EF320A65116B5070C66E3B9844461BB0FFA47F
Malicious:	false
Preview:	1.8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8968_1934143332\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.405914533496662
Encrypted:	false
SSDEEP:	3:3FFhAWAUNhRKpEbXKS2XAXMWxQHJCzhiFfASvAcWxQHJCr2SkhSA:3FFWeRl2QIpCU4SvrpCSSkhSA
MD5:	58D3CA1189DF439D0538A75912496BCF
SHA1:	99AF5B6A006A6929CC08744D1B54E3623FEC2F36
SHA-256:	A946DB31A6A985BDB64EA9F403294B479571CA3C22215742BDC26EA1CF123437
SHA-512:	AFD7F140E89472D4827156EC1C48DA488B0D06DAAA737351C7BEC6BC12EDFC4443460C4AC169287350934CA66FB2F883347ED8084C62CAF9F883A736243194A2
Malicious:	false
Preview:	{.. "description" : "AutoLaunch Protocols Preregistration",.. "name" : "Protocol Preregistration",.. "version" : "1.0.0.8"..}

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8968_1934143332\protocols.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	4.532278538438865
Encrypted:	false
SSDEEP:	48:O//uidcRcrcNc0cTc8cs+PcrcNc0cTc8csLcrcNc0cTc8cstcrcNc0cTc8csH:O//uWJ2UH
MD5:	6BBB18BB210B0AF189F5D76A65F7AD80
SHA1:	87B804075E78AF64293611A637504273FADFE718
SHA-256:	01594D510A1BBC016897EC89402553ECA423DFDC8B82BAFBC5653BF0C976F57C
SHA-512:	4788EDCFA3911C3BB2BE8FC447166C330E8AC389F74E8C44E13238EAD2FA45C8538AEE325BD0D1CC40D91AD47DEA1AA94A92148A62983144FDECFF2130EE120D
Malicious:	false
Preview:	{.. "allow": [.. {.. "origins": [.. "https://.get.microsoft.com",.. "https://.apps.microsoft.com".. ],.. "protocol": "ms-windows-store".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.live.com",.. "https://sharepoint.com".. ],.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://[a-z1-9-]word-edit.officeapps.live.com",.. "https://[a-z1-9-]word-view.officeapps.live.com",.. "https://[a-z1-9-]onenote.officeapps.live.com",.. "https://[a-z1-9-]eap.officeapps.live.com",.. "https://[a-z1-9-]shared.officeapps.live.com",.. "https://[a-z1-9-]afhs.officeapps.live.com",.. "https://[a-z1-9-]vhs.officeapps.live.com",.. "https://[a-z1-9-]optin.online.office.com".. ],.. "use_regex": true,.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.li

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.319093004317624
Encrypted:	false
SSDEEP:	12:Yp6UD+B0Dkv/PRVHvhP56s/PRVHynaRpEu0Dkv/PRVHJnVUIEGx56s/C:Yp6UiB08DJP5xDaaRpJ08DJjx5M
MD5:	2F24E1919D91B421FBC3A4D6563D7D15
SHA1:	6E29EE48FDE722E9C62DEE41C9CFC8A9F8F56205
SHA-256:	5A47223ABCC3A767CEEEBC1C6B346E78CA1AB5871B713D492EB3C47171E9DEEB
SHA-512:	24105766D47B297E2BA048B89EC6DA61075B89E5AB35780FE33A513C61E139F1AE39027B3CAF93360E62464804777CD1AFABFF76A53BC73CA7BEFF6EC6BF1E19
Malicious:	false
Preview:	{"logTime": "0830/120757", "correlationVector":"C73F64875A194FD5AA574CD0647DCFC4","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0830/120808", "correlationVector":"rZBE1K8pe2M05EHsoGPOy/","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0830/120808", "correlationVector":"1C825796C2BB4194ADFAE022C1BC84BE","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0830/120808", "correlationVector":"RJAAuMBgay7ripIPMra0jK","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1723345423\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1723345423\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1723345423\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1723345423\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1723345423\c223ff56-8aca-43b9-8f87-e93f618a5328.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\09035530-8fd0-4381-a337-57e468a3f155.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8968_1725228834\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.513196838149539
Encrypted:	false
SSDEEP:	48:DEtcdObXXsJwruzBdLXuHplQkDpZ2AnVLdObKaXsJwruzngdLXuHplQk+21:t3urQkDOGnIurQkz
MD5:	771E5E88EA19B97060F21AA6F2B34253
SHA1:	B6AE5F69395B544F191F6D9AF7EFEF0DF56285E3
SHA-256:	52E1F741AF56D5612660449227673F9E75F71FB03893C8AD36DF43AA1658B970
SHA-512:	E2AD56C7D895BB430F03A75FEC3B293D202266C87153A6FA905AC159339D336169B0510E2C2DE615532FC8EF84296A9DB4A8C390F5978ED45A591D155FEC06D5
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......@.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......O..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux..Y.`..........................p...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.`..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.`....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............$.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9AFG59UJMAEQBXF5UBR1.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.511102590139623
Encrypted:	false
SSDEEP:	48:DEnVLdObKaXsJwruzBdLXuHplQkDpZ2AnVLdObKaXsJwruzngdLXuHplQk+21:m3urQkDOGnIurQkz
MD5:	ED7A01B2919B01F701F7A5F0619C0888
SHA1:	6287A6882A52F8099AC01A48CF2C870810B3BB37
SHA-256:	F4205385BFF3EFD19EA46F226E9DB553A516671095F1FBEBCE07E0445B5D36AF
SHA-512:	00AF47A9231C1F0EDE5B8260BB30B3044971F556992AD69625658D42C75697756A806A431D6E10F2059EA9794580F6909E766480777D24A23E7A6A36D22F302E
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......@.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y.`..PROGRA~2.........O.I.Y.`....................V.......a.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux..Y.`..........................p...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.`..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.`....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............$.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W6JIHN0R6WRKBRMWKOVE.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.513196838149539
Encrypted:	false
SSDEEP:	48:DEtcdObXXsJwruzBdLXuHplQkDpZ2AnVLdObKaXsJwruzngdLXuHplQk+21:t3urQkDOGnIurQkz
MD5:	771E5E88EA19B97060F21AA6F2B34253
SHA1:	B6AE5F69395B544F191F6D9AF7EFEF0DF56285E3
SHA-256:	52E1F741AF56D5612660449227673F9E75F71FB03893C8AD36DF43AA1658B970
SHA-512:	E2AD56C7D895BB430F03A75FEC3B293D202266C87153A6FA905AC159339D336169B0510E2C2DE615532FC8EF84296A9DB4A8C390F5978ED45A591D155FEC06D5
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......@.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......O..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux..Y.`..........................p...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.`..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.`....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............$.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.511102590139623
Encrypted:	false
SSDEEP:	48:DEnVLdObKaXsJwruzBdLXuHplQkDpZ2AnVLdObKaXsJwruzngdLXuHplQk+21:m3urQkDOGnIurQkz
MD5:	ED7A01B2919B01F701F7A5F0619C0888
SHA1:	6287A6882A52F8099AC01A48CF2C870810B3BB37
SHA-256:	F4205385BFF3EFD19EA46F226E9DB553A516671095F1FBEBCE07E0445B5D36AF
SHA-512:	00AF47A9231C1F0EDE5B8260BB30B3044971F556992AD69625658D42C75697756A806A431D6E10F2059EA9794580F6909E766480777D24A23E7A6A36D22F302E
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......@.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y.`..PROGRA~2.........O.I.Y.`....................V.......a.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux..Y.`..........................p...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.`..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.`....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............$.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579767336461621
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	705d1a22a19751c0856355777c700e65
SHA1:	30ad91437d4a503d8711542270e779caedd68a9e
SHA256:	aa78a471bb738b74a22f5bbbc68fd2337f50912a35af13f96480ce007cec35ed
SHA512:	6f4fce656542e98a81cd40e969bcba1c7174c886d8d4b641ac9a79982bf406649633ea163354dd47da7a5fe41dbd53b40f3b4542b70cc5202f6b07a2c4fc564e
SSDEEP:	12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTT:mqDEvCTbMWu7rQYlBQcBiT6rprG8asT
TLSH:	81159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D1AB26 [Fri Aug 30 11:21:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F3280BB5AA3h
jmp 00007F3280BB53AFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F3280BB558Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F3280BB555Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F3280BB814Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F3280BB8198h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F3280BB8181h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	b567e99dd02394872a3dbf9945a019a3	False	0.28692708333333333	data	5.1659632187087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 14:07:48.540971994 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 30, 2024 14:07:58.248558998 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 30, 2024 14:07:59.114886045 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.114918947 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.115052938 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.115323067 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.115358114 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.115483046 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.115631104 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.115647078 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.115782022 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.115798950 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.644771099 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.644807100 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.644865036 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.645199060 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.645205975 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.645281076 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.646430016 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.646457911 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.646503925 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.647027969 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.647042990 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.647272110 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.647281885 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.647604942 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.647619963 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.649992943 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.650002003 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.650058031 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.650298119 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:07:59.650310993 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:07:59.784811974 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.784866095 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.787101030 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.787123919 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.787575006 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.787595034 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.788115025 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.788167953 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.788583994 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.788633108 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.796161890 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:07:59.796170950 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:07:59.796251059 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:07:59.798410892 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:07:59.798420906 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:07:59.802252054 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.802318096 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.803493977 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.803508043 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.803767920 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.803828001 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.804230928 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.804244995 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.856887102 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.906811953 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.906852007 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.906886101 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.906898975 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.906925917 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.906939030 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.907320976 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.907357931 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.907481909 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.914279938 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914298058 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914300919 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914335012 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914345980 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.914347887 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914360046 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914374113 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:07:59.914397955 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.914397955 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:07:59.914416075 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.001311064 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.001332045 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.001400948 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.001410007 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.004738092 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.007452011 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.007467985 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.007571936 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.007579088 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.008698940 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.091167927 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.091187000 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.091274023 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.091283083 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.091304064 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.091355085 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.091362000 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.091401100 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.091403008 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.092700958 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.113480091 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.116401911 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.126315117 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.126322985 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.126322985 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.126442909 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.126451015 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.127217054 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.127271891 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.127361059 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.127418041 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.129374027 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.129380941 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.130297899 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.130350113 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.141597986 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.146704912 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.146780014 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.164380074 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.164401054 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.164478064 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.164557934 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.165344000 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.165412903 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.171250105 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.171349049 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.179104090 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.179204941 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.179419041 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.179430962 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.179635048 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.179646015 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.180217028 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.180227041 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.180366993 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.180372953 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.186810970 CEST	49747	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.186826944 CEST	443	49747	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.211761951 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:00.211775064 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:00.258641958 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.268188953 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:00.268505096 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:00.268512011 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:00.269505978 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:00.269568920 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:00.270692110 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:00.270764112 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:00.270874023 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:00.270880938 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:00.279983997 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.280045033 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.280105114 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.280390024 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.280440092 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.280457020 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.280464888 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.280759096 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.280766010 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.283390045 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.283442974 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.283620119 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.283624887 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.285598993 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.285670996 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.285828114 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:00.285835028 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:00.391696930 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:00.391762972 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:00.391886950 CEST	49754	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:00.391895056 CEST	443	49754	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:01.045609951 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.045648098 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.045727968 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.047164917 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.047204018 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.697736979 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.697926044 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.702678919 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.702691078 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.702919960 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.738049984 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.784504890 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.854561090 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854593992 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.854628086 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854654074 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.854677916 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854825974 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854917049 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854928970 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.854963064 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854974985 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.968651056 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.968712091 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.969043970 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.969043970 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.969160080 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.969177008 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.999114990 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.999142885 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:01.999296904 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.999649048 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:01.999664068 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.303801060 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.303817034 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.304161072 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.304188013 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.304223061 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.304256916 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.304596901 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.304609060 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.305437088 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.305449963 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.308533907 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.308752060 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.308901072 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.308916092 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.309075117 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.309099913 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.309217930 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.309469938 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.310399055 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.310468912 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.310631990 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.310720921 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.353765011 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.443254948 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.541364908 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:02.541383028 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:02.541486979 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:02.541619062 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:02.541632891 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:02.641932011 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.642019033 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:02.660064936 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:02.660077095 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.660367966 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.662311077 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:02.708492994 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.767946005 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.768179893 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.768201113 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.768560886 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.768621922 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.769226074 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.769278049 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.770492077 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.770553112 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.770703077 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.770710945 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.782325029 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.782519102 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.782529116 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.782877922 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.782943964 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.783543110 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.783596992 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.783746958 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.783807039 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.783929110 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.783936024 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.822395086 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.874449015 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.878494024 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.878596067 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.878644943 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.879129887 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.879143000 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.879153967 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.879188061 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.898169994 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.898333073 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.898380995 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.898822069 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.898832083 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:02.898854971 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.898874998 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:02.919003963 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.919054031 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.919148922 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:02.919754982 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:02.919759989 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:02.919791937 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 30, 2024 14:08:02.919795990 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 30, 2024 14:08:03.004120111 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.004400015 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.004412889 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.005295038 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.005359888 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.006270885 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.006330013 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.006596088 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.006603956 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102580070 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102608919 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102628946 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.102638006 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102690935 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102735043 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.102741957 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102756977 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.102787971 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.103514910 CEST	49765	443	192.168.2.4	142.250.65.196
Aug 30, 2024 14:08:03.103524923 CEST	443	49765	142.250.65.196	192.168.2.4
Aug 30, 2024 14:08:03.182241917 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.182267904 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.182502985 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.182662010 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.182674885 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.213285923 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.213306904 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.213372946 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.213507891 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.213525057 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.650643110 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.651000023 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.651014090 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.651350021 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.651405096 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.651964903 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.652044058 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.652285099 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.652349949 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.694812059 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.695647955 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.695655107 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.702435970 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.702450991 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.702789068 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.702861071 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.703386068 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.703438044 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.703598022 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.703654051 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.758349895 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.758359909 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.758393049 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.805213928 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:09.938426018 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:09.938441992 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:09.938494921 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:09.938735008 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:09.938746929 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:09.943715096 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:09.943814039 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:09.943891048 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:09.944057941 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:09.944092035 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.409301996 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:10.409327030 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:10.409564972 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:10.410548925 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:10.410562038 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:10.581316948 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.581643105 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.581690073 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.582973003 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.583060980 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.584453106 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.584528923 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.584638119 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.584654093 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.593961954 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.594314098 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.594325066 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.594679117 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.594691992 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.594774008 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.594774008 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.594782114 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.594907045 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.595357895 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.596472979 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.596546888 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.596705914 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.640506029 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.664839029 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.664849043 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.686165094 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.686201096 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.686230898 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.686233997 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.686280012 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.687392950 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 30, 2024 14:08:10.687407970 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 30, 2024 14:08:10.862593889 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.862648964 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.862659931 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.865331888 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.865411997 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.865420103 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.871634007 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.871689081 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.871694088 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.877911091 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.877957106 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.877964973 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.884141922 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.884202957 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.884210110 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.890677929 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.890753984 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.890762091 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.896806955 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.896888971 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.896897078 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.904076099 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.904169083 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.904176950 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.952826023 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.953051090 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.953077078 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.953151941 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.953162909 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.953212023 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.957746983 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.957808018 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.957817078 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.964174986 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.964242935 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.964251995 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.970442057 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.970504999 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.970519066 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.976758957 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.976851940 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.976859093 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.983217955 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.983314991 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.983321905 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.989165068 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.989521027 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.989533901 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.995505095 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:10.995570898 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:10.995578051 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.001404047 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.001451015 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.001456976 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.006823063 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.006891012 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.006897926 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.012214899 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.012316942 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.012324095 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.017669916 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.018645048 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.018654108 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.023202896 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.023272038 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.023278952 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.028762102 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.028847933 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.028855085 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.036119938 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.036181927 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.036190033 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.044656038 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.044743061 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.044759989 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.044903040 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.044950008 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.044956923 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.047348976 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.047430038 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.047436953 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.050878048 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.050925016 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.050931931 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.054544926 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.054594994 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.054601908 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.057980061 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.058036089 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.058043003 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.061496019 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.061580896 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.061588049 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.065077066 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.065141916 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.065149069 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.068630934 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.068696022 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.068702936 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.072195053 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.072249889 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.072256088 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.075442076 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.075503111 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.075510979 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.079005957 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.079088926 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.079096079 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.082444906 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.082523108 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.082531929 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.085962057 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.086081982 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.086090088 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.089240074 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.089302063 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.089313984 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.092909098 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.092967033 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.092974901 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.096288919 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.096398115 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.096404076 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.099817038 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.099900961 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.099908113 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.103302956 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.103429079 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.103436947 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.108536959 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.108582020 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.108589888 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.110145092 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.110186100 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.110193968 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.113753080 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.113835096 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.113842964 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.116543055 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.116592884 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.116601944 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.117868900 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.117933989 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.119822979 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.119853020 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.119877100 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.119888067 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.120049953 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.122267962 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.122277975 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.122520924 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.122999907 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.125807047 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.125904083 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.125926971 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.125974894 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.126104116 CEST	49774	443	192.168.2.4	142.250.185.225
Aug 30, 2024 14:08:11.126115084 CEST	443	49774	142.250.185.225	192.168.2.4
Aug 30, 2024 14:08:11.194746971 CEST	49672	443	192.168.2.4	173.222.162.32
Aug 30, 2024 14:08:11.194776058 CEST	443	49672	173.222.162.32	192.168.2.4
Aug 30, 2024 14:08:11.258502007 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.755337954 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.800504923 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987523079 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987544060 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987550974 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987580061 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987596989 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987611055 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987613916 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.987636089 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987651110 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.987651110 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.987675905 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.987819910 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987833977 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.987875938 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.987890005 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:11.987895012 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.988297939 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:11.988372087 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:12.479007006 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:12.479065895 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:12.479115963 CEST	49776	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:12.479132891 CEST	443	49776	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:13.378149033 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.378165960 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.378552914 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.378559113 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.378592014 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.378638029 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.379062891 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.379062891 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.379076958 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.379086971 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.421581030 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.421658039 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.421885014 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.422480106 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.422513962 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.925790071 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.926817894 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.927109003 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.929404974 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.929405928 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.929415941 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.929416895 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.929694891 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.929702997 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.930274010 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.930362940 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.930372953 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.930450916 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.931142092 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.931256056 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.933619022 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.933670998 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.935213089 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.935288906 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.936043024 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.936048985 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.936316967 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.936393023 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.936467886 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.936475039 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.936711073 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.936714888 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:13.978147984 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:13.978151083 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.046297073 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.046715975 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.046768904 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.047496080 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.047560930 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.049143076 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.049143076 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.049150944 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.054476023 CEST	49785	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.054502010 CEST	443	49785	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.127192020 CEST	49783	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.127202034 CEST	443	49783	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:14.130254030 CEST	49784	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:14.130259037 CEST	443	49784	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:17.219343901 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:17.219412088 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:17.219480991 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:17.220007896 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:17.220072031 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:17.220170021 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:28.198786974 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.198821068 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.199125051 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.199199915 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.199208021 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.199395895 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.199408054 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.199450970 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.199583054 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.199632883 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.652019978 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.652262926 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.652276993 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.652564049 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.652889967 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.652947903 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.662031889 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.662229061 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.662265062 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.662560940 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.662848949 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.662915945 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.696609974 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.703455925 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.749933004 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:28.749977112 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:28.750052929 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:28.750360012 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:28.750386953 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.302958965 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.303256989 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.303281069 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.304133892 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.304198027 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.305411100 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.305469990 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.305705070 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.305721045 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.352547884 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.406583071 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.407987118 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.407998085 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.408026934 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.408039093 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.408068895 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.408190012 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.408543110 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 30, 2024 14:08:29.408567905 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 30, 2024 14:08:29.695667982 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.695697069 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:29.695749998 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.696877003 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.696917057 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:29.697025061 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.697242022 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.697253942 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:29.697452068 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.697479010 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.152924061 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153280973 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.153301954 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153352976 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153522015 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.153536081 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153767109 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153876066 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.154490948 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.154577971 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.154936075 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.154999971 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.155261993 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.156049013 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.200500011 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.200510025 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.266473055 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.266736984 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.267026901 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.267026901 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.291246891 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.291310072 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.291455030 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.291795015 CEST	49791	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.291815996 CEST	443	49791	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.574227095 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.574244022 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:38.969082117 CEST	49733	53	192.168.2.4	162.159.36.2
Aug 30, 2024 14:08:38.973855019 CEST	53	49733	162.159.36.2	192.168.2.4
Aug 30, 2024 14:08:38.973915100 CEST	49733	53	192.168.2.4	162.159.36.2
Aug 30, 2024 14:08:38.978760958 CEST	53	49733	162.159.36.2	192.168.2.4
Aug 30, 2024 14:08:39.449588060 CEST	49733	53	192.168.2.4	162.159.36.2
Aug 30, 2024 14:08:39.454669952 CEST	53	49733	162.159.36.2	192.168.2.4
Aug 30, 2024 14:08:39.454739094 CEST	49733	53	192.168.2.4	162.159.36.2
Aug 30, 2024 14:08:39.762300014 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:39.762324095 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:39.762432098 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:39.763058901 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:39.763070107 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.475848913 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.475914955 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.481344938 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.481353998 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.481543064 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.494497061 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.540502071 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.755642891 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.755673885 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.755692005 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.755742073 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.755752087 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.755800962 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.756417036 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.756462097 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.756479025 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.756489038 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.756516933 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.756891012 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.756934881 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.761498928 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.761507034 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:40.761519909 CEST	49735	443	192.168.2.4	13.85.23.86
Aug 30, 2024 14:08:40.761524916 CEST	443	49735	13.85.23.86	192.168.2.4
Aug 30, 2024 14:08:43.563324928 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:43.563390970 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:43.563455105 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:43.571526051 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:43.571585894 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:43.571640968 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:48.698961973 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:48.698987007 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:48.761477947 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:48.761495113 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:54.698031902 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:54.698072910 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:54.698168993 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:54.704032898 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:54.704077959 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:54.704163074 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:54.704288960 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:54.704303980 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:54.707300901 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:54.707314968 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.230710983 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.230963945 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.231197119 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.231218100 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.231513977 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.231789112 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.231812954 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.231997967 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.232054949 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.232130051 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.232419014 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.232477903 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.276281118 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.276281118 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:57.126223087 CEST	58900	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:57.131149054 CEST	53	58900	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:57.131217957 CEST	58900	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:57.136142015 CEST	53	58900	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:57.578811884 CEST	58900	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:57.597007036 CEST	53	58900	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:57.597090006 CEST	58900	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:09:02.227333069 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:02.227351904 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:02.227366924 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:02.227391005 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:10.087224007 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:10.087320089 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:10.087382078 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:10.092025995 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:10.092091084 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:10.092140913 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:28.571116924 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:28.571141958 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:28.586728096 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:28.586764097 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:33.711863041 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:09:33.711886883 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 30, 2024 14:09:33.774364948 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:09:33.774386883 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 30, 2024 14:09:47.228470087 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:47.228503942 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:47.228521109 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:47.228549957 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:55.091674089 CEST	49737	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:55.091701031 CEST	443	49737	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:55.106816053 CEST	49736	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:55.106842041 CEST	443	49736	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:57.253557920 CEST	58905	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.253632069 CEST	443	58905	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.253714085 CEST	58905	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.253787041 CEST	58906	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.253806114 CEST	443	58906	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.253865957 CEST	58906	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.253961086 CEST	58905	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.254005909 CEST	443	58905	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.254098892 CEST	58906	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.254121065 CEST	443	58906	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.714092016 CEST	443	58905	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.714710951 CEST	58905	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.714736938 CEST	443	58905	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.715061903 CEST	443	58905	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.715481043 CEST	58905	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.715544939 CEST	443	58905	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.737107992 CEST	443	58906	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.737381935 CEST	58906	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.737401962 CEST	443	58906	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.737725973 CEST	443	58906	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.738051891 CEST	58906	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.738123894 CEST	443	58906	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.758899927 CEST	58905	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.790132999 CEST	58906	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.816891909 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:57.816910982 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:57.816979885 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:57.817153931 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:57.817163944 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.286165953 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.286443949 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:58.286456108 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.286734104 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.287118912 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:58.287168980 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.287483931 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:58.332489014 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.421914101 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.421960115 CEST	443	58907	23.55.235.170	192.168.2.4
Aug 30, 2024 14:09:58.422002077 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:58.422362089 CEST	58907	443	192.168.2.4	23.55.235.170
Aug 30, 2024 14:09:58.422372103 CEST	443	58907	23.55.235.170	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 14:07:55.890831947 CEST	53	61094	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:57.214317083 CEST	63068	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:57.214515924 CEST	55699	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:58.158194065 CEST	53	55574	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:58.191091061 CEST	53	53675	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.635065079 CEST	64252	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.635231972 CEST	61505	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.635513067 CEST	56729	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.635767937 CEST	61498	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.636075974 CEST	63813	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.636208057 CEST	61049	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.636698008 CEST	54829	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.636941910 CEST	50426	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.642237902 CEST	53	61505	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.642354012 CEST	53	64252	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.642441988 CEST	53	56729	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.642864943 CEST	53	61498	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.643111944 CEST	53	63813	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.643779993 CEST	53	61049	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.645473957 CEST	53	54829	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.649195910 CEST	53	50426	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.788146973 CEST	56941	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.788501024 CEST	62511	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:07:59.795012951 CEST	53	56941	1.1.1.1	192.168.2.4
Aug 30, 2024 14:07:59.795135021 CEST	53	62511	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:01.542179108 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.854195118 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.992315054 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.992353916 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.992388964 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.992531061 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.992583990 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:01.993020058 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.998179913 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.998440027 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.998867989 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:01.998867989 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.093379021 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.093390942 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.093660116 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.093676090 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.093693972 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.093923092 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.094760895 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.095038891 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.095535994 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.173465967 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.173465967 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.187201977 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.224765062 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.268024921 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.269126892 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.269356012 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.302735090 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.442682981 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.442858934 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.537908077 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.540070057 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.540077925 CEST	443	54225	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:02.540277004 CEST	54225	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:02.880502939 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.181936979 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.329850912 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.329865932 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.330671072 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.336107016 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.336117983 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.336127996 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.336220026 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.336507082 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.337512970 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.338404894 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.338763952 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.339091063 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.339106083 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.353255033 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.438236952 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.438261986 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.438513994 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.438800097 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.452744007 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.453037977 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.453507900 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.468000889 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.468025923 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:03.468286991 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.504270077 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:03.567924976 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:09.930012941 CEST	58845	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:09.930191994 CEST	61809	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:09.936640024 CEST	53	58845	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:09.937969923 CEST	53	61809	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:11.390803099 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:11.390897989 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:11.493065119 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:11.527192116 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:11.527312994 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:11.553580046 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:11.553997040 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:11.607609987 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:11.679111004 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:11.695651054 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:11.740303993 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:12.999476910 CEST	53	57662	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:13.369666100 CEST	55480	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:13.369666100 CEST	61417	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:13.370002985 CEST	50912	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:13.370198011 CEST	53380	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:13.377306938 CEST	53	55480	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:13.377316952 CEST	53	61417	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:13.377329111 CEST	53	50912	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:13.378050089 CEST	53	53380	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:13.414206982 CEST	55260	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:13.414206982 CEST	63349	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:08:13.421072960 CEST	53	55260	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:13.421082973 CEST	53	63349	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:17.814928055 CEST	138	138	192.168.2.4	192.168.2.255
Aug 30, 2024 14:08:28.198529005 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.552668095 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.643210888 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.643225908 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.643241882 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.643301964 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.643882036 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.645848989 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.646032095 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.646523952 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.646640062 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.647578001 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.739695072 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.739841938 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.739850998 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.739857912 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.739866018 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.740195990 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.740781069 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.741753101 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.743302107 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.743469954 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.745069981 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:28.834768057 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:28.869240999 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.689752102 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.689753056 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.691010952 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.785686016 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:29.786564112 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:29.786823988 CEST	443	55997	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:29.787158012 CEST	55997	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:29.994611025 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.152599096 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.152620077 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153469086 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153481007 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153491974 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.153666973 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.155133963 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.155709982 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.155842066 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.251281977 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.251338959 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.251348019 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.251354933 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.251760006 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.251898050 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:30.347465038 CEST	443	60714	162.159.61.3	192.168.2.4
Aug 30, 2024 14:08:30.384277105 CEST	60714	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:08:32.235143900 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.235316038 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.278918028 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.335072994 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.349123955 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.349133015 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.349390984 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.386455059 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.392942905 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.393172979 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.393506050 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.433309078 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.473891020 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.518340111 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.528924942 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.528924942 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.730736017 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.823236942 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.823427916 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.824434042 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.824470043 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.825123072 CEST	49256	443	192.168.2.4	142.250.65.174
Aug 30, 2024 14:08:32.920232058 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:32.924377918 CEST	443	49256	142.250.65.174	192.168.2.4
Aug 30, 2024 14:08:38.968568087 CEST	53	64881	162.159.36.2	192.168.2.4
Aug 30, 2024 14:08:39.695646048 CEST	53	65314	1.1.1.1	192.168.2.4
Aug 30, 2024 14:08:54.694917917 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.010966063 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.228403091 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.228441000 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.228451014 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.228598118 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.228607893 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.228981972 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.230808973 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.230925083 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.231406927 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.231667042 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.323492050 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.334281921 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.334315062 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.334322929 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.334330082 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.334532976 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.334583998 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.335053921 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.335295916 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.335515022 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:55.613110065 CEST	443	61900	172.64.41.3	192.168.2.4
Aug 30, 2024 14:08:55.650665045 CEST	61900	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:08:57.125802040 CEST	53	51640	1.1.1.1	192.168.2.4
Aug 30, 2024 14:09:02.798648119 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:02.798819065 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:02.799146891 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:02.799267054 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.182020903 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.256721020 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.257662058 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.275471926 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.275525093 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.275666952 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.275733948 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.275757074 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.275857925 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.275945902 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.350956917 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.368942976 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.369136095 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.463915110 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.464704990 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.464860916 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:03.469038010 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:03.470046997 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.470175028 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.912395000 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.926851034 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:03.926867008 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:03.927716017 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.927953005 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.928431988 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.928442001 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.928714037 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.928731918 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:03.944931030 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.012406111 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.016490936 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.026793957 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.028053999 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.028063059 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.028383970 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.034890890 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.035216093 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.041631937 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.041704893 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.043509960 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.051816940 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.052119017 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.115907907 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.151340961 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.173823118 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.176548004 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.197818041 CEST	443	64037	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:04.198519945 CEST	64037	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:04.358051062 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:04.358165979 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:04.453151941 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:04.454014063 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:04.454242945 CEST	443	62396	172.64.41.3	192.168.2.4
Aug 30, 2024 14:09:04.454431057 CEST	62396	443	192.168.2.4	172.64.41.3
Aug 30, 2024 14:09:04.455028057 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:04.455127954 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:04.912769079 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:04.913685083 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:04.913696051 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:04.913706064 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:04.913718939 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:04.914071083 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:04.914575100 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:04.914774895 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:05.014816046 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:05.014883041 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:05.014893055 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:05.015055895 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:05.040446997 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:05.073959112 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:05.074393034 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:05.074656963 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:05.074666023 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:05.075228930 CEST	60122	443	192.168.2.4	172.253.115.84
Aug 30, 2024 14:09:05.200337887 CEST	443	60122	172.253.115.84	192.168.2.4
Aug 30, 2024 14:09:33.652885914 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:33.653053045 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.115428925 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.115700006 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.116097927 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.116172075 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.116533041 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.116545916 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.116677046 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.116693020 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.134007931 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.216028929 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.216579914 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.216615915 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.216782093 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.216840982 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.229950905 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.230700016 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.230719090 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.231091976 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:34.231451035 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.259025097 CEST	57828	443	192.168.2.4	142.250.81.238
Aug 30, 2024 14:09:34.331377983 CEST	443	57828	142.250.81.238	192.168.2.4
Aug 30, 2024 14:09:57.244761944 CEST	64089	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:09:57.244911909 CEST	63593	53	192.168.2.4	1.1.1.1
Aug 30, 2024 14:09:57.251873970 CEST	53	63593	1.1.1.1	192.168.2.4
Aug 30, 2024 14:09:57.252118111 CEST	53	64089	1.1.1.1	192.168.2.4
Aug 30, 2024 14:09:57.253216028 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.556022882 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.710360050 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.710412025 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.712093115 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.712167978 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.712249994 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.712678909 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.712733030 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.714464903 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.714993000 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.715130091 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.715770006 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.716413975 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.812279940 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.812289000 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.812295914 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.812303066 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.812597036 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.812697887 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.813822031 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.814553022 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.815356970 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.816359997 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.816488981 CEST	53482	443	192.168.2.4	162.159.61.3
Aug 30, 2024 14:09:57.910001993 CEST	443	53482	162.159.61.3	192.168.2.4
Aug 30, 2024 14:09:57.946569920 CEST	53482	443	192.168.2.4	162.159.61.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 30, 2024 14:07:57.214317083 CEST	192.168.2.4	1.1.1.1	0x242a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:57.214515924 CEST	192.168.2.4	1.1.1.1	0x66c5	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 30, 2024 14:07:59.635065079 CEST	192.168.2.4	1.1.1.1	0x13dd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.635231972 CEST	192.168.2.4	1.1.1.1	0xff95	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:07:59.635513067 CEST	192.168.2.4	1.1.1.1	0x762b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.635767937 CEST	192.168.2.4	1.1.1.1	0xf737	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:07:59.636075974 CEST	192.168.2.4	1.1.1.1	0xbebb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.636208057 CEST	192.168.2.4	1.1.1.1	0xef05	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:07:59.636698008 CEST	192.168.2.4	1.1.1.1	0xddd4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.636941910 CEST	192.168.2.4	1.1.1.1	0x6620	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:07:59.788146973 CEST	192.168.2.4	1.1.1.1	0xc24f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.788501024 CEST	192.168.2.4	1.1.1.1	0x1443	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:08:09.930012941 CEST	192.168.2.4	1.1.1.1	0x2a75	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:09.930191994 CEST	192.168.2.4	1.1.1.1	0xb6c8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 30, 2024 14:08:13.369666100 CEST	192.168.2.4	1.1.1.1	0x40f2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.369666100 CEST	192.168.2.4	1.1.1.1	0xb29d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:08:13.370002985 CEST	192.168.2.4	1.1.1.1	0xa296	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.370198011 CEST	192.168.2.4	1.1.1.1	0x7944	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:08:13.414206982 CEST	192.168.2.4	1.1.1.1	0x1e80	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 30, 2024 14:08:13.414206982 CEST	192.168.2.4	1.1.1.1	0xe1f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:09:57.244761944 CEST	192.168.2.4	1.1.1.1	0x16c2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:09:57.244911909 CEST	192.168.2.4	1.1.1.1	0x8eaf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 30, 2024 14:07:57.221419096 CEST	1.1.1.1	192.168.2.4	0x66c5	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:07:57.221513987 CEST	1.1.1.1	192.168.2.4	0x242a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:07:59.111820936 CEST	1.1.1.1	192.168.2.4	0xe430	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:07:59.111820936 CEST	1.1.1.1	192.168.2.4	0xe430	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.642237902 CEST	1.1.1.1	192.168.2.4	0xff95	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:07:59.642354012 CEST	1.1.1.1	192.168.2.4	0x13dd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.642354012 CEST	1.1.1.1	192.168.2.4	0x13dd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.642441988 CEST	1.1.1.1	192.168.2.4	0x762b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.642441988 CEST	1.1.1.1	192.168.2.4	0x762b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.642864943 CEST	1.1.1.1	192.168.2.4	0xf737	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:07:59.643111944 CEST	1.1.1.1	192.168.2.4	0xbebb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.643111944 CEST	1.1.1.1	192.168.2.4	0xbebb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.643779993 CEST	1.1.1.1	192.168.2.4	0xef05	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:07:59.645473957 CEST	1.1.1.1	192.168.2.4	0xddd4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.645473957 CEST	1.1.1.1	192.168.2.4	0xddd4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.649195910 CEST	1.1.1.1	192.168.2.4	0x6620	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:07:59.795012951 CEST	1.1.1.1	192.168.2.4	0xc24f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.795012951 CEST	1.1.1.1	192.168.2.4	0xc24f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:07:59.795135021 CEST	1.1.1.1	192.168.2.4	0x1443	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:08:08.854969025 CEST	1.1.1.1	192.168.2.4	0x2041	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:09.936640024 CEST	1.1.1.1	192.168.2.4	0x2a75	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:09.936640024 CEST	1.1.1.1	192.168.2.4	0x2a75	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:09.937969923 CEST	1.1.1.1	192.168.2.4	0xb6c8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:09.942931890 CEST	1.1.1.1	192.168.2.4	0xe0d9	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:09.942931890 CEST	1.1.1.1	192.168.2.4	0xe0d9	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:11.150305986 CEST	1.1.1.1	192.168.2.4	0xa7bc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:11.150305986 CEST	1.1.1.1	192.168.2.4	0xa7bc	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:11.150742054 CEST	1.1.1.1	192.168.2.4	0x7dfc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:12.175620079 CEST	1.1.1.1	192.168.2.4	0xb1d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:12.178092957 CEST	1.1.1.1	192.168.2.4	0x936b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:12.178092957 CEST	1.1.1.1	192.168.2.4	0x936b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.377306938 CEST	1.1.1.1	192.168.2.4	0x40f2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.377306938 CEST	1.1.1.1	192.168.2.4	0x40f2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.377316952 CEST	1.1.1.1	192.168.2.4	0xb29d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:08:13.377329111 CEST	1.1.1.1	192.168.2.4	0xa296	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.377329111 CEST	1.1.1.1	192.168.2.4	0xa296	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.378050089 CEST	1.1.1.1	192.168.2.4	0x7944	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:08:13.421072960 CEST	1.1.1.1	192.168.2.4	0x1e80	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:08:13.421082973 CEST	1.1.1.1	192.168.2.4	0xe1f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:13.421082973 CEST	1.1.1.1	192.168.2.4	0xe1f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:14.207104921 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:14.207104921 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:15.218880892 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:15.218880892 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:16.222547054 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:16.222547054 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:18.234201908 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:18.234201908 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:08:22.235300064 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 30, 2024 14:08:22.235300064 CEST	1.1.1.1	192.168.2.4	0x3806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:09:57.251873970 CEST	1.1.1.1	192.168.2.4	0x8eaf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 30, 2024 14:09:57.252118111 CEST	1.1.1.1	192.168.2.4	0x16c2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 14:09:57.252118111 CEST	1.1.1.1	192.168.2.4	0x16c2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

clients2.googleusercontent.com

slscr.update.microsoft.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	13.107.246.60	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:07:59 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 12:07:59 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 12:07:59 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240830T120759Z-16579567576c4hpgz3uh2pbn5g000000038g00000000dcc9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-30 12:07:59 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	13.107.246.60	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:07:59 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 12:07:59 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 12:07:59 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240830T120759Z-16579567576vpzq62mgx0my8kw00000003m0000000004vwu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-30 12:07:59 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-30 12:07:59 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-30 12:08:00 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-30 12:08:00 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-30 12:08:00 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	172.64.41.3	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:00 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:00 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4a9e96e01c3ff-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:00 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 da 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	172.64.41.3	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:00 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:00 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4a9e96f8280d3-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:00 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5c 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom\()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	172.64.41.3	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:00 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:00 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4a9e97df141e9-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:00 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9f 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	172.64.41.3	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:00 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:00 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4a9e97819c33e-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:00 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fc 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	162.159.61.3	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:00 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:00 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4a9ea2dab7d08-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:00 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f6 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49759	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:01 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 12:08:01 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=77332 Date: Fri, 30 Aug 2024 12:08:01 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:02 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 12:08:02 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=77284 Date: Fri, 30 Aug 2024 12:08:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-30 12:08:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49764	142.250.65.174	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:02 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-30 12:08:02 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 30 Aug 2024 12:08:02 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49763	142.250.65.174	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:02 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-30 12:08:02 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 30 Aug 2024 12:08:02 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	142.250.65.196	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:03 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-30 12:08:03 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 30 Aug 2024 11:46:07 GMT Expires: Sat, 07 Sep 2024 11:46:07 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 1316 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-30 12:08:03 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-30 12:08:03 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-30 12:08:03 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-30 12:08:03 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-30 12:08:03 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49775	13.107.246.60	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:10 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 12:08:10 UTC	559	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 12:08:10 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240830T120810Z-16579567576txfkctmnqv2e9c4000000030000000000cxv9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-30 12:08:10 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49774	142.250.185.225	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:10 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 12:08:10 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nOvINz5Fw81daL-eYWBzTi1b5Ow_Yvrq6jQUop1j-mmHSL_gvlHkHH1mmh0Q44ZeL-m5A X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 29 Aug 2024 20:38:51 GMT Expires: Fri, 29 Aug 2025 20:38:51 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Age: 55759 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-30 12:08:10 UTC	825	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 17 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 a2 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c 0d Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe e3 Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 49 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,pI
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 61 Data Ascii: =%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhPa
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 c3 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 90 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-08-30 12:08:10 UTC	1390	IN	Data Raw: 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f 97 Data Ascii: N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49776	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:11 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bdyh3LYKrut4ddd&MD=zmbULpMs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-30 12:08:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 50efd3a4-605a-4bc4-a8f2-f1d75c5f0625 MS-RequestId: 2f101ff2-0f55-4034-8915-da8b70e5cdcf MS-CV: BmSxWY0G6EaxVgPl.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 30 Aug 2024 12:08:11 GMT Connection: close Content-Length: 24490
2024-08-30 12:08:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-30 12:08:11 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49783	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4aa3f8eeec32f-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a4 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49785	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4aa3f8fc718ae-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c0 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49784	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-30 12:08:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4aa3f8b1a42cd-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ee 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	152.195.19.97	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:29 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725624491&P2=404&P3=2&P4=j1BbytyHTndJcZ0VXyMHn6AqM%2fwglnbtYM9gmT8ikZHW8okmO2qUdCp4Kful9ngSIw6zTN%2fl1lET303SIkT54A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: RJAAuMBgay7ripIPMra0jK Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 12:08:29 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4946240 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 30 Aug 2024 12:08:29 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-30 12:08:29 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49791	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-30 12:08:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4aaa50f0242df-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d ea 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 16 00 02 c0 43 c0 43 00 01 00 01 00 00 00 16 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 16 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49790	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-30 12:08:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-08-30 12:08:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 30 Aug 2024 12:08:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bb4aaa4efc9422e-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 12:08:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d ef 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 cf 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	16801	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:08:40 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bdyh3LYKrut4ddd&MD=zmbULpMs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-30 12:08:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e6cd6ad1-d567-4be1-80c8-b9718cfdaff5 MS-RequestId: 4323ea6c-d3f1-4f90-895c-72d1e035dcf6 MS-CV: 7mO/FE9omkClQnZK.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 30 Aug 2024 12:08:40 GMT Connection: close Content-Length: 30005
2024-08-30 12:08:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-30 12:08:40 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	58907	23.55.235.170	443	7416	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 12:09:58 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-30 12:09:58 UTC	331	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Date: Fri, 30 Aug 2024 12:09:58 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.65a13617.1725019798.a47f62e Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	08:07:51
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x560000
File size:	917'504 bytes
MD5 hash:	705D1A22A19751C0856355777C700E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:07:52
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:07:52
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:07:52
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,13542706911432229970,12581857463732113695,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:07:52
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:07:56
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7112 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:07:57
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:07:57
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff64ed70000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:07:57
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7240 --field-trial-handle=2212,i,2265168672538141757,17795521020320533337,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff64ed70000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:08:06
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:08:07
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:08:07
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4780 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:08:08
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8
Imagebase:	0x7ff64ed70000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:08:08
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6064 --field-trial-handle=2536,i,9333111614937463249,9925871214484712163,262144 /prefetch:8
Imagebase:	0x7ff64ed70000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:08:14
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:08:14
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2052,i,8548949589357949916,9248762715934791281,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:08:22
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:08:23
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2052,i,18235629407557685321,15700958897455494623,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:08:35
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:08:36
Start date:	30/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2024,i,16407138273607858583,5544686832840600377,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	1398
Total number of Limit Nodes:	30

Executed Functions

Function 0057F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0057F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005BF474
IsIconic.USER32(00000000), ref: 005BF47D
ShowWindow.USER32(00000000,00000009), ref: 005BF48A
SetForegroundWindow.USER32(00000000), ref: 005BF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 005BF4AA
GetCurrentThreadId.KERNEL32 ref: 005BF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 005BF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 005BF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 005BF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 005BF4DE
SetForegroundWindow.USER32(00000000), ref: 005BF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 005BF4F6
keybd_event.USER32(00000012,00000000), ref: 005BF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 005BF50B
keybd_event.USER32(00000012,00000000), ref: 005BF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 005BF519
keybd_event.USER32(00000012,00000000), ref: 005BF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 005BF528
keybd_event.USER32(00000012,00000000), ref: 005BF52D
SetForegroundWindow.USER32(00000000), ref: 005BF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 005BF557

Strings

Shell_TrayWnd, xrefs: 005BF46F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 85cc95fe4a588b003705b53d42e390bd9dafba54df3e8ba4b17d3651f35de13d
Instruction ID: 57948dee5c691e6eb4a13d54ad89aae031ac2a9eeefdbda19e27505456dbfed7
Opcode Fuzzy Hash: 85cc95fe4a588b003705b53d42e390bd9dafba54df3e8ba4b17d3651f35de13d
Instruction Fuzzy Hash: 6D313D71A4021CBBEB306BB55D4AFBF7E6CEB44B50F100475FA01EA1D1C6B56900EBA0

Function 005642DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0056430D

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

GetCurrentProcess.KERNEL32(?,005FCB64,00000000,?,?), ref: 00564422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00564429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00564454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00564466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00564474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0056447B
GetSystemInfo.KERNEL32(?,?,?), ref: 005644A0

Strings

kernel32.dll, xrefs: 0056444F
GetNativeSystemInfo, xrefs: 00564460
|O, xrefs: 005A36F8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5b2b953a7ffffba6c5690f58dbe99c9d8d7f41f5979583e88c770c245f3262cb
Instruction ID: 61f969268761befac822268f4a501e8e46d037c5b8ff529e8cb3de88cf3bd3de
Opcode Fuzzy Hash: 5b2b953a7ffffba6c5690f58dbe99c9d8d7f41f5979583e88c770c245f3262cb
Instruction Fuzzy Hash: A1A1A571D0A2D0DFEB11C769BC415A97FA6BB37344B0878A9E0419FB22D6344608DFA1

Function 005642A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,005650AA,?,?,00000000,00000000), ref: 005642B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005650AA,?,?,00000000,00000000), ref: 005642C9
LoadResource.KERNEL32(?,00000000,?,?,005650AA,?,?,00000000,00000000,?,?,?,?,?,?,00564F20), ref: 005A35BE
SizeofResource.KERNEL32(?,00000000,?,?,005650AA,?,?,00000000,00000000,?,?,?,?,?,?,00564F20), ref: 005A35D3
LockResource.KERNEL32(005650AA,?,?,005650AA,?,?,00000000,00000000,?,?,?,?,?,?,00564F20,?), ref: 005A35E6

Strings

SCRIPT, xrefs: 005642BF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 05e4ffe187c261871bf36afa8bda0f24c67d0efb9ee6ff0e7b5638c802280439
Instruction ID: 8f4675ce843b8751f1b86a5b545e455af76653ea70486b332e21d7224f79cbf7
Opcode Fuzzy Hash: 05e4ffe187c261871bf36afa8bda0f24c67d0efb9ee6ff0e7b5638c802280439
Instruction Fuzzy Hash: 19115A78240604AFD7218B65DD58F277FB9FBD5B51F208569F402D6250DB71D814DA20

Function 005A2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00562B6B

Part of subcall function 00563A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00631418,?,00562E7F,?,?,?,00000000), ref: 00563A78

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00622224), ref: 005A2C10
ShellExecuteW.SHELL32(00000000,?,?,00622224), ref: 005A2C17

Strings

runas, xrefs: 005A2C0B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 8e60513334e272eb44827784a8d07dd8e912a8973c80dec0a4bb04b2de862393
Instruction ID: e1d791292cf98f436e9748f69490b94ade04c8d9bcefc0abb4a6369911e2e4a1
Opcode Fuzzy Hash: 8e60513334e272eb44827784a8d07dd8e912a8973c80dec0a4bb04b2de862393
Instruction Fuzzy Hash: 9511A231608646AAC714FF64D85A9BEBFA5FBE1350F04182DF082571B2CF358A49D752

Function 005CDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,005A5222), ref: 005CDBCE
GetFileAttributesW.KERNELBASE(?), ref: 005CDBDD
FindFirstFileW.KERNEL32(?,?), ref: 005CDBEE
FindClose.KERNEL32(00000000), ref: 005CDBFA

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 12f8301f4f8e973a3ec1d70aae661506ef2731b91deae1be18032db543e42cdb
Instruction ID: a1ad79b8282bd1d37a71195b75bfdb84e1ab597b7dfa4743838b3de016cc30d4
Opcode Fuzzy Hash: 12f8301f4f8e973a3ec1d70aae661506ef2731b91deae1be18032db543e42cdb
Instruction Fuzzy Hash: 6CF0A7304105145B82206BB89D0DD7A3F7CAF41334B104726F476C20E0EBB46D58D9A5

Function 005EAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 005EB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 005EB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 005EB1D4
_wcslen.LIBCMT ref: 005EB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 005EB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 005EB236
_wcslen.LIBCMT ref: 005EB332

Part of subcall function 005D05A7: GetStdHandle.KERNEL32(000000F6), ref: 005D05C6

_wcslen.LIBCMT ref: 005EB34B
_wcslen.LIBCMT ref: 005EB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005EB3B6
GetLastError.KERNEL32(00000000), ref: 005EB407
CloseHandle.KERNEL32(?), ref: 005EB439
CloseHandle.KERNEL32(00000000), ref: 005EB44A
CloseHandle.KERNEL32(00000000), ref: 005EB45C
CloseHandle.KERNEL32(00000000), ref: 005EB46E
CloseHandle.KERNEL32(?), ref: 005EB4E3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: ff510f0d84e45b71572782f0aeb683771ff46bbb1f5c29993876054d8452a058
Instruction ID: 1bdc4158b12f0ecc339e2523ca2e98361e9c287fd852d9d8b4d31086484e14d6
Opcode Fuzzy Hash: ff510f0d84e45b71572782f0aeb683771ff46bbb1f5c29993876054d8452a058
Instruction Fuzzy Hash: 73F19B315042419FDB28EF25C895B2BBFE5BF85314F14885DF89A9B2A2DB31EC44CB52

Function 0056D730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0056D807
timeGetTime.WINMM ref: 0056DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0056DB28
TranslateMessage.USER32(?), ref: 0056DB7B
DispatchMessageW.USER32(?), ref: 0056DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0056DB9F
Sleep.KERNELBASE(0000000A), ref: 0056DBB1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: d2c6f095d630ef6e3079ca6b3b99be56363648a005724d59dca45771bbe1547d
Instruction ID: dc1a6d43b5abcd25fdabea302799c904a16c96d86fb113c2effeb48066a7050d
Opcode Fuzzy Hash: d2c6f095d630ef6e3079ca6b3b99be56363648a005724d59dca45771bbe1547d
Instruction Fuzzy Hash: A142D130B08746DFD728CF24C899BAABFB1BF85304F14895DE4558B2A1D774E844DBA2

Function 0056344D Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00563A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00631418,?,00562E7F,?,?,?,00000000), ref: 00563A78

Part of subcall function 00563357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00563379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0056356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 005A318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 005A31CE
RegCloseKey.ADVAPI32(?), ref: 005A3210
_wcslen.LIBCMT ref: 005A3277
_wcslen.LIBCMT ref: 005A3286

Strings

P[, xrefs: 0056349D
\, xrefs: 005A328C
Software\AutoIt v3\AutoIt, xrefs: 00563560
\Include\, xrefs: 00563527
Include, xrefs: 005A3184, 005A31C5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$P[$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-3831711137
Opcode ID: 2c6171b9268e08e4404f92d9e02737e1d1328e5ae6b52f5d6f3167f8bf2f4bf7
Instruction ID: 531cfb115dc3b169e7b6beb16b33258e29543e5bfb18344e336f2e4d4b56ec91
Opcode Fuzzy Hash: 2c6171b9268e08e4404f92d9e02737e1d1328e5ae6b52f5d6f3167f8bf2f4bf7
Instruction Fuzzy Hash: 6971CF714043069EE314EF25EC959AFBFE9FF95740F40182EF545931A0EB349A48CBA2

Function 00562CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00562D07
RegisterClassExW.USER32(00000030), ref: 00562D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00562D42
InitCommonControlsEx.COMCTL32(?), ref: 00562D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00562D6F
LoadIconW.USER32(000000A9), ref: 00562D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00562D94

Strings

AutoIt v3 GUI, xrefs: 00562D23
0, xrefs: 00562CE9
+, xrefs: 00562CF0
TaskbarCreated, xrefs: 00562D37

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 14b93da2cbb3038dc3b3365b5ab41a0703abce4c28661776f2301a48c61b2d31
Instruction ID: a3d5c1df377036dab655ea3565a450044223d36f3c41e424699f3b2dc8ca8750
Opcode Fuzzy Hash: 14b93da2cbb3038dc3b3365b5ab41a0703abce4c28661776f2301a48c61b2d31
Instruction Fuzzy Hash: E021E4B594120CAFDB00DFA4E949BEDBFB9FB09701F00412AE611EA2A0D7B51548DF90

Function 005A065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005A039A: CreateFileW.KERNELBASE(00000000,00000000,?,005A0704,?,?,00000000,?,005A0704,00000000,0000000C), ref: 005A03B7

GetLastError.KERNEL32 ref: 005A076F
__dosmaperr.LIBCMT ref: 005A0776
GetFileType.KERNELBASE(00000000), ref: 005A0782
GetLastError.KERNEL32 ref: 005A078C
__dosmaperr.LIBCMT ref: 005A0795
CloseHandle.KERNEL32(00000000), ref: 005A07B5
CloseHandle.KERNEL32(?), ref: 005A08FF
GetLastError.KERNEL32 ref: 005A0931
__dosmaperr.LIBCMT ref: 005A0938

Strings

H, xrefs: 005A08BD

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 42c53fef9b73047e104182fba69e0a37c921e6db1ed7ceae364d08ae05a0ba98
Instruction ID: 24bd7fa640777d56b1c5f8438d4837006a25f35c938c8ef7d52d92bcb478e007
Opcode Fuzzy Hash: 42c53fef9b73047e104182fba69e0a37c921e6db1ed7ceae364d08ae05a0ba98
Instruction Fuzzy Hash: D1A13132A201098FDF19AF68DC65BAE3FA1FB4A320F14115DF815EB2D1DB359816CB91

Function 00562B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00562B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00562B9D
LoadIconW.USER32(00000063), ref: 00562BB3
LoadIconW.USER32(000000A4), ref: 00562BC5
LoadIconW.USER32(000000A2), ref: 00562BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00562BEF
RegisterClassExW.USER32(?), ref: 00562C40

Part of subcall function 00562CD4: GetSysColorBrush.USER32(0000000F), ref: 00562D07
Part of subcall function 00562CD4: RegisterClassExW.USER32(00000030), ref: 00562D31
Part of subcall function 00562CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00562D42
Part of subcall function 00562CD4: InitCommonControlsEx.COMCTL32(?), ref: 00562D5F
Part of subcall function 00562CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00562D6F
Part of subcall function 00562CD4: LoadIconW.USER32(000000A9), ref: 00562D85
Part of subcall function 00562CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00562D94

Strings

#, xrefs: 00562C16
AutoIt v3, xrefs: 00562C2F
0, xrefs: 00562C0F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d5aca4a943831ccf46f56f027072ad3ef251e8ebb375812944c41639d57716e7
Instruction ID: e93db6060310267db3081e45d51b725678bf2757de96db0202d7f99e8deb6712
Opcode Fuzzy Hash: d5aca4a943831ccf46f56f027072ad3ef251e8ebb375812944c41639d57716e7
Instruction Fuzzy Hash: 17214F71E01318ABEB109F95ED45AA97FB6FB49B50F00202AE500EB6A0D3B51A44DFD0

Function 00563170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0056316A,?,?), ref: 005631D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0056316A,?,?), ref: 00563204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00563227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0056316A,?,?), ref: 00563232
CreatePopupMenu.USER32 ref: 00563246
PostQuitMessage.USER32(00000000), ref: 00563267

Strings

TaskbarCreated, xrefs: 0056322D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 771947a7c1e8aa3de05770eb9660e5f9ccaba8a0105121f6a5d0467ce523145d
Instruction ID: dfa0422477fbf606d7dd18d50c7ace49d8f50848135bc63979d1c32f62ce3e6c
Opcode Fuzzy Hash: 771947a7c1e8aa3de05770eb9660e5f9ccaba8a0105121f6a5d0467ce523145d
Instruction Fuzzy Hash: 5B412535244209ABEB142B78DD6EB7D3E5AFB47310F040529FA02CB2A2CB759A44D7E1

Function 0056B710 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0056BB4E

Strings

p%c, xrefs: 0056BB32
`g, xrefs: 0056BA72, 0056BB6B, 005B024F, 005B0263
p%c, xrefs: 0056B8DC
x#c, xrefs: 005B0207
`}, xrefs: 005B030A
x#c, xrefs: 005B0168

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: `g$`}$p%c$p%c$x#c$x#c
API String ID: 1385522511-1563395700
Opcode ID: 26e2e347d87e21c5c875a75a677585bbc22813eec710d8ca7d643c646e330ac7
Instruction ID: 588eae6379e8060a26c8e85224ea41533fa3790f7c64bab08d486479836f3d72
Opcode Fuzzy Hash: 26e2e347d87e21c5c875a75a677585bbc22813eec710d8ca7d643c646e330ac7
Instruction Fuzzy Hash: 4232A175A0020ADFEB24CF58C898ABEBFB5FF44314F148459E905AB2A1D774ED81CB91

Function 00562C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00562C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00562CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00561CAD,?), ref: 00562CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00561CAD,?), ref: 00562CCF

Strings

edit, xrefs: 00562CAC
AutoIt v3, xrefs: 00562C89, 00562C8E, 00562C8F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: eed32cf2f63875d4f90a01039d4b537d05e762241e7548d82fd9fac75a516c04
Instruction ID: 3606be0f7192f0872952bc87345f144e9fb9980ef51615cde42c9d4d992744df
Opcode Fuzzy Hash: eed32cf2f63875d4f90a01039d4b537d05e762241e7548d82fd9fac75a516c04
Instruction Fuzzy Hash: 5CF0DA755402987BFB311717AD08EB76EBEE7C7F50B00106EFA00EB5A0C6651858DEB0

Function 005CE97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 005CE997
QueryPerformanceFrequency.KERNEL32(?), ref: 005CE9A5
Sleep.KERNEL32(00000000), ref: 005CE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 005CE9B7
Sleep.KERNELBASE ref: 005CE9F3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: c59ae01d2a4a504095d2537ed87606e50947ad9d9fabae03ac734d10a37b02c8
Instruction ID: ec012c03ddf563aef069b7a47dad358cfb0cb62fd7098af206d601457f25db56
Opcode Fuzzy Hash: c59ae01d2a4a504095d2537ed87606e50947ad9d9fabae03ac734d10a37b02c8
Instruction Fuzzy Hash: 5F011735C0162DDBCF00ABE5D95AAEDBF78FF19701F00455AE502B2241CB349655DBA2

Function 005610F3 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00561BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00561BF4
Part of subcall function 00561BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00561BFC
Part of subcall function 00561BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00561C07
Part of subcall function 00561BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00561C12
Part of subcall function 00561BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00561C1A
Part of subcall function 00561BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00561C22

Part of subcall function 00561B4A: RegisterWindowMessageW.USER32(00000004,?,005612C4), ref: 00561BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0056136A
OleInitialize.OLE32 ref: 00561388
CloseHandle.KERNEL32(00000000,00000000), ref: 005A24AB

Strings

8-, xrefs: 0056117E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: 8-
API String ID: 1986988660-1897437538
Opcode ID: 71c175dc2dcd07edcf8c99090f9287f19ee05608e084ddebd6a9c8c7b24c0201
Instruction ID: c748520d7dc737723554cd326da12ffff4f693210efa9dc276df866a1231ea75
Opcode Fuzzy Hash: 71c175dc2dcd07edcf8c99090f9287f19ee05608e084ddebd6a9c8c7b24c0201
Instruction Fuzzy Hash: 6871ABF59112098FC384DF79AE496653EE2FB8B364714A62AD14ACF362EB304445CFD8

Function 00563B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00563B0F,SwapMouseButtons,00000004,?), ref: 00563B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00563B0F,SwapMouseButtons,00000004,?), ref: 00563B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00563B0F,SwapMouseButtons,00000004,?), ref: 00563B83

Strings

Control Panel\Mouse, xrefs: 00563B3E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: c2060c0693db0dfdde6473abcd08fe2feb08696fee93b13a426cbdf163dd4107
Instruction ID: f3b9c3511c79be3855dac458c078de7300088e4863b287ab49e09befa22b0cef
Opcode Fuzzy Hash: c2060c0693db0dfdde6473abcd08fe2feb08696fee93b13a426cbdf163dd4107
Instruction Fuzzy Hash: AA112AB5511208FFDB208FA5DC48EEEBBBCFF05744B104969A805D7160E6319E45A760

Function 00563923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 005A33A2

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00563A04

Strings

Line: , xrefs: 005A33EB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 212af2244fc065c53e37d46b8c31cce26cf4336526e812ccf33f1e6cdc88c8d4
Instruction ID: b1a2d5e2054b52df1a2798e10788fce9242baed08c72d227fdf53948ca77d24a
Opcode Fuzzy Hash: 212af2244fc065c53e37d46b8c31cce26cf4336526e812ccf33f1e6cdc88c8d4
Instruction Fuzzy Hash: 0131C171508305AAD721EB20DC49BEFBBD8BB81714F10492AF599931A1EB709A48CBC2

Function 00562DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 005A2C8C

Part of subcall function 00563AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00563A97,?,?,00562E7F,?,?,?,00000000), ref: 00563AC2

Part of subcall function 00562DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00562DC4

Strings

`eb, xrefs: 005A2C85
X, xrefs: 005A2C5A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`eb
API String ID: 779396738-317726664
Opcode ID: 223e0ed0c9937614dd6beb8d37501c1f02421ba25403e7689642cb820a148d79
Instruction ID: f50e9279a5a7bb6c8b5275856e66fafbeea22f6d8c399aab1f071f4ec9beaf94
Opcode Fuzzy Hash: 223e0ed0c9937614dd6beb8d37501c1f02421ba25403e7689642cb820a148d79
Instruction Fuzzy Hash: 27218171A00698ABDB01AF94D849BEE7FFDAF89314F008059E405A7241DFB45A898FA1

Function 0057FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00580668

Part of subcall function 005832A4: RaiseException.KERNEL32(?,?,?,0058068A,?,00631444,?,?,?,?,?,?,0058068A,00561129,00628738,00561129), ref: 00583304

__CxxThrowException@8.LIBVCRUNTIME ref: 00580685

Strings

Unknown exception, xrefs: 00580692

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 9105f707bb70b6f974a58e2cbc3fcbabb6af0bc51324b0a301c86411a319bd8e
Instruction ID: df18cc162a88ce3e648aed537f24cba5d60aab9468d90d882609bcab0aa2822f
Opcode Fuzzy Hash: 9105f707bb70b6f974a58e2cbc3fcbabb6af0bc51324b0a301c86411a319bd8e
Instruction Fuzzy Hash: 3DF0C234A0020EB78F10F665EC4AC9E7F6C7E80710B608531BD28E65D1EF71DA29CB90

Function 005CC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00563923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00563A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 005CC259
KillTimer.USER32(?,00000001,?,?), ref: 005CC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005CC270

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 04c6c365a93c440b4680a13dae560c4b3f5a6035d5464ca41a26deb0617e48be
Instruction ID: 69a608fd144a79ab78b87a7c6a49d38ea67b47f9c0d0da1495b84de9a47f874a
Opcode Fuzzy Hash: 04c6c365a93c440b4680a13dae560c4b3f5a6035d5464ca41a26deb0617e48be
Instruction Fuzzy Hash: 87319374904344AFEB329FA48899BEBBFEDAB17304F04049ED5DEA7241C7745A88CB51

Function 005986AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,005985CC,?,00628CC8,0000000C), ref: 00598704
GetLastError.KERNEL32(?,005985CC,?,00628CC8,0000000C), ref: 0059870E
__dosmaperr.LIBCMT ref: 00598739

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 7e2c7a659d17286528747e278bf0f6f0545b9a34dda734c2482b3a9b5db17862
Instruction ID: b2e649caa150290754a43eaa3e7a9dbe4dfede93ba3caa85cf2d8b4e62f1900d
Opcode Fuzzy Hash: 7e2c7a659d17286528747e278bf0f6f0545b9a34dda734c2482b3a9b5db17862
Instruction Fuzzy Hash: 04016633A0422026DE216774E849B7E2F4AABE37B4F390519FD04CF1D2EEA18C81C290

Function 0056DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0056DB7B
DispatchMessageW.USER32(?), ref: 0056DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0056DB9F
Sleep.KERNELBASE(0000000A), ref: 0056DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 005B1CC9

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: b07ad6e58dafe042e5673470de8eca0f07bdc4b6feba9b627cf0b8a73278ed1f
Instruction ID: 0381a45f39786d90906ba926434ad33f69d08abe4ffb03855f3094a1d520f775
Opcode Fuzzy Hash: b07ad6e58dafe042e5673470de8eca0f07bdc4b6feba9b627cf0b8a73278ed1f
Instruction Fuzzy Hash: 1BF05E306443459BEB70DBA08C59FEA7BB9FB95310F504A29E61AC70D0DB34A448DB69

Function 00571310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005717F6

Strings

CALL, xrefs: 005717C6

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 6c3c7fe68cad4f693600edc34ceac79d325ec9d5488ce177088929e3c426a1c6
Instruction ID: 7b6e0f512903d247e7f42a4c747181363337e67e11c500bc67aa7b600ee77c32
Opcode Fuzzy Hash: 6c3c7fe68cad4f693600edc34ceac79d325ec9d5488ce177088929e3c426a1c6
Instruction Fuzzy Hash: 9522AB706086029FC714CF18D484A2ABFF1BF85314F24892DF48A8B3A2D735E945EB96

Function 00563837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00563908

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: da32294ee9addcfdd8199a4d0c1a5ded55af73fe40a94034eae42a13b97e6e88
Instruction ID: bfa2bf33ea4e4cc8b6c059c9d4a1172b9771551972d71b6ed4f2399a7fe5c568
Opcode Fuzzy Hash: da32294ee9addcfdd8199a4d0c1a5ded55af73fe40a94034eae42a13b97e6e88
Instruction Fuzzy Hash: 8B3171715057019FE720DF64D8857DBBFE8FB8A708F00092EF59A97250E771AA48CB92

Function 0057F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0057F661

Part of subcall function 0056D730: GetInputState.USER32 ref: 0056D807

Sleep.KERNEL32(00000000), ref: 005BF2DE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 173b18eab106a0e985c719b5b1f0e61dd833ef60638edded479821abaf75a91f
Instruction ID: 42a37cbf05c94e007f783ff3d4c37f1e13ed6c85c2b4f5fc86ee4063d5be92bf
Opcode Fuzzy Hash: 173b18eab106a0e985c719b5b1f0e61dd833ef60638edded479821abaf75a91f
Instruction Fuzzy Hash: D8F08C352402069FD310FF69D949BAABFE8FF95760F004429E85AC7360EB70A884CB91

Function 005F2598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 005F2649

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: cf052122cb3c2795d47add6e570772f280d095f56627b7a9d0420cbb9dbe93d9
Instruction ID: 07177163fbf497e4f6c41f8155b416f96df7653ab0930955e7ca0288076340cd
Opcode Fuzzy Hash: cf052122cb3c2795d47add6e570772f280d095f56627b7a9d0420cbb9dbe93d9
Instruction Fuzzy Hash: 2521D3B420061AAFD710DF14C8D0936BF99FB44368F50806CE9978B392CB75ED41CB90

Function 005F13B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 005F1420

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0da28f7f32952d1a01adaa46cc12270165a03754d03e7a94cf75ec199ae5703d
Instruction ID: bda506406bea3123edf0f2e7526d4ba1bd3c71c01041db1ff280982d7e0cb8b7
Opcode Fuzzy Hash: 0da28f7f32952d1a01adaa46cc12270165a03754d03e7a94cf75ec199ae5703d
Instruction Fuzzy Hash: DE318C30204607EFDB14EF25C499B79BBA2BF85324F048168E8564B392DB79EC41CB90

Function 00564ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00564E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00564EDD,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564E9C
Part of subcall function 00564E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00564EAE
Part of subcall function 00564E90: FreeLibrary.KERNEL32(00000000,?,?,00564EDD,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564EFD

Part of subcall function 00564E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,005A3CDE,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564E62
Part of subcall function 00564E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00564E74
Part of subcall function 00564E59: FreeLibrary.KERNEL32(00000000,?,?,005A3CDE,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564E87

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 1661f64809499158fc4ae722176512641969c0b8135078f9e1093cd3a60bc9cd
Instruction ID: d5371178f7c80e52af6a9924bc2fc3fb5dd90cce2e0cd430de7f07e21e686b8e
Opcode Fuzzy Hash: 1661f64809499158fc4ae722176512641969c0b8135078f9e1093cd3a60bc9cd
Instruction Fuzzy Hash: 26112731600306AACF25BB60DC0AFADBFA4BF80710F10842EF542A72C1EE719E059B90

Function 00598402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00598440

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 061e8103beef77c8eab26febb8b78389b6c22a86683d9eada68af0866077f584
Instruction ID: 993a2d9ce033df2e1931e4b702f49534513d94bffc6786991b074cf873020765
Opcode Fuzzy Hash: 061e8103beef77c8eab26febb8b78389b6c22a86683d9eada68af0866077f584
Instruction Fuzzy Hash: 5711487190410AAFCF05DF58E9409AE7BF9FF49304F104069F808AB312DA31DA11CBA4

Function 00595000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00594C7D: RtlAllocateHeap.NTDLL(00000008,00561129,00000000,?,00592E29,00000001,00000364,?,?,?,0058F2DE,00593863,00631444,?,0057FDF5,?), ref: 00594CBE

_free.LIBCMT ref: 0059506C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 2bd7c8f2b119f0e63222dfdf46951ab1876bbe7e4019de8f9dd92a6920311119
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: D5012B722047056BEB22CE55984995AFFE8FB85370F65061DE18483280E6306805C7B4

Function 005F29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,005F14B5,?), ref: 005F2A01

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f979a00148e64ab97d5bde5c5ba48d054d2c27fc1af535945652f44c1f9030ae
Instruction ID: 359c1a534ee4078e6d7041d7801452ada636c6910ee6a0b21d1980c1d1d55fe8
Opcode Fuzzy Hash: f979a00148e64ab97d5bde5c5ba48d054d2c27fc1af535945652f44c1f9030ae
Instruction Fuzzy Hash: 3101D876340A469FD325CA2DC554B323F92FBC5314F698468C2878B251D7BAFC82CBA0

Function 0058E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 3e1767bf12fe37cef258ed45fb7c8f79e40c8083ac65fdfe4264adfd439113e5
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: D5F0F932510A15A6DB313A6AAC0EB563FA8BFD3330F140715FC25B21D1EB7098028BA5

Function 005F149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 005F14EB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0044f22cbf8a0a451f2be8debf8675b947b0021e76ec7791894b3f268e58be62
Instruction ID: 5afd4f8e33bd89e1cfb44de45fd335cb1b4a1bccaec8691bd3cd244ba7aac718
Opcode Fuzzy Hash: 0044f22cbf8a0a451f2be8debf8675b947b0021e76ec7791894b3f268e58be62
Instruction Fuzzy Hash: 2F01D435304A4ADF9B20DF69C444836BF95FFC436475480ADE94ACB702D676DD82CB84

Function 00594C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00561129,00000000,?,00592E29,00000001,00000364,?,?,?,0058F2DE,00593863,00631444,?,0057FDF5,?), ref: 00594CBE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0a56ba087c2d39a78bad55224d8beb8cc815414038849eec6971b42ee9b1dbd2
Instruction ID: 31c05d72e917ba25b47d1df675c445b337aa72be548f5f1649a2f0bd4380539c
Opcode Fuzzy Hash: 0a56ba087c2d39a78bad55224d8beb8cc815414038849eec6971b42ee9b1dbd2
Instruction Fuzzy Hash: 75F0E9316022256FDF216F629C09F5A3F8CBF917A1B144625BC16EA281CB30DC02CFE0

Function 00593820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00631444,?,0057FDF5,?,?,0056A976,00000010,00631440,005613FC,?,005613C6,?,00561129), ref: 00593852

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1e637d3bb46a135c890fe28074254d114092eab6d831f6b86d0e42ef4fdf4dc7
Instruction ID: 9a24541bb70629b7439eba79d0218b494749ed152aa238fe94784ba5dbf8c83a
Opcode Fuzzy Hash: 1e637d3bb46a135c890fe28074254d114092eab6d831f6b86d0e42ef4fdf4dc7
Instruction Fuzzy Hash: 3AE0E531202226D6EF2136679C08B9A3E49BF827B0F050431BC05A6980CB10DD0196E1

Function 00564F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564F6D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 36b0a90ada26c57bb7bdd15d8510626eb8df2d378f258adb872ab1119ab29d25
Instruction ID: db2a35593e30a16efdd1f306a5109a365c6272b943cddfbb3e6c67ee843df83d
Opcode Fuzzy Hash: 36b0a90ada26c57bb7bdd15d8510626eb8df2d378f258adb872ab1119ab29d25
Instruction Fuzzy Hash: 4BF01C71105752CFDB389F64D494822FFE5BF243193108A7EE1DA83611C7319848DF10

Function 005F2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 005F2A66

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: defc02b45abfab953519d403d37b2228cca59fab979ed349f021e79c883864fd
Instruction ID: 6d92a4deb45600d354f861f40be3034622b3c3ae4f0d743146883082f6458fb4
Opcode Fuzzy Hash: defc02b45abfab953519d403d37b2228cca59fab979ed349f021e79c883864fd
Instruction Fuzzy Hash: 7BE0DF7235011BAEC710EA30EC849FE7F5CFB90391B00483AAD56C2100DB388985D6A0

Function 00562DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00562DC4

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 8367f80a164099600d66bbbb99e0ee221496cebc9d541ac7e9d2c296cb2de524
Instruction ID: 377d722ff6cd5009401eeec6090e54421aa104eeb31afa96b4342c8a684ba572
Opcode Fuzzy Hash: 8367f80a164099600d66bbbb99e0ee221496cebc9d541ac7e9d2c296cb2de524
Instruction Fuzzy Hash: 44E0CD766001245BC7109658DC09FEA7BDDEFC8790F044071FD09D7258D964AD84C550

Function 00562B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00563837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00563908

Part of subcall function 0056D730: GetInputState.USER32 ref: 0056D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00562B6B

Part of subcall function 005630F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0056314E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: fb4862e89fa554f351c924d8f96923236a0791f8dd917974a8bc2faa55eaa1d8
Instruction ID: 61ad2452b79b0d5a762fdf3f65311a41163c47c4e44652e3826206c4b3064e04
Opcode Fuzzy Hash: fb4862e89fa554f351c924d8f96923236a0791f8dd917974a8bc2faa55eaa1d8
Instruction Fuzzy Hash: 7FE0862170424606C708BB75A85A5BDAF9AFBE2351F40193EF542872A3CE2546498252

Function 005C3D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C3D18

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 6023837fd172485d132d2af32081250d12fb30805498a7103f0fc81dcefa9bb2
Instruction ID: eb47631e49b07f75ccab25ed21349f29a9df84ecfd2a401894af493e397d4aae
Opcode Fuzzy Hash: 6023837fd172485d132d2af32081250d12fb30805498a7103f0fc81dcefa9bb2
Instruction Fuzzy Hash: DCD012E06A43087EFB0083718D0BEBB369CC726A81F004BA47A02D64C1D9A4DE084130

Function 005A039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,005A0704,?,?,00000000,?,005A0704,00000000,0000000C), ref: 005A03B7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b10183a33320e5e34236ba13df26030a475e1153b921b8dd6e47c7ec350848f
Instruction ID: 895ef4f8e746235e960ab876434527a564fe459d882ae90aa1053e4d5f9a3775
Opcode Fuzzy Hash: 5b10183a33320e5e34236ba13df26030a475e1153b921b8dd6e47c7ec350848f
Instruction Fuzzy Hash: F6D06C3204010DBBDF028F84DD06EDA3FAAFB48714F014010BE1896020C736E831EB90

Function 00561CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00561CBC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: e643c6a4c3d9f80140e6736a423ae5020ec5ab5e4a7cadf4471121a77075c573
Instruction ID: 7e0457b6a4e1b35536ac8acfd1bfcead4348ba37d7a977bbf7752c7c6c666b66
Opcode Fuzzy Hash: e643c6a4c3d9f80140e6736a423ae5020ec5ab5e4a7cadf4471121a77075c573
Instruction Fuzzy Hash: 2BC09236280309AFF3148B80BD5AF207B66A358B11F049001F609AA5E3C3A22828EA90

Non-executed Functions

Function 005F9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 005F961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005F965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 005F969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005F96C9
SendMessageW.USER32 ref: 005F96F2
GetKeyState.USER32(00000011), ref: 005F978B
GetKeyState.USER32(00000009), ref: 005F9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005F97AE
GetKeyState.USER32(00000010), ref: 005F97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005F97E9
SendMessageW.USER32 ref: 005F9810
SendMessageW.USER32(?,00001030,?,005F7E95), ref: 005F9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 005F992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 005F9941
SetCapture.USER32(?), ref: 005F994A
ClientToScreen.USER32(?,?), ref: 005F99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 005F99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005F99D6
ReleaseCapture.USER32 ref: 005F99E1
GetCursorPos.USER32(?), ref: 005F9A19
ScreenToClient.USER32(?,?), ref: 005F9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 005F9A80
SendMessageW.USER32 ref: 005F9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 005F9AEB
SendMessageW.USER32 ref: 005F9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 005F9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 005F9B4A
GetCursorPos.USER32(?), ref: 005F9B68
ScreenToClient.USER32(?,?), ref: 005F9B75
GetParent.USER32(?), ref: 005F9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 005F9BFA
SendMessageW.USER32 ref: 005F9C2B
ClientToScreen.USER32(?,?), ref: 005F9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 005F9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 005F9CDE
SendMessageW.USER32 ref: 005F9D01
ClientToScreen.USER32(?,?), ref: 005F9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 005F9D82

Part of subcall function 00579944: GetWindowLongW.USER32(?,000000EB), ref: 00579952

GetWindowLongW.USER32(?,000000F0), ref: 005F9E05

Strings

`g, xrefs: 005F9990
F, xrefs: 005F9D07
@GUI_DRAGID, xrefs: 005F997D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$`g
API String ID: 3429851547-1384372844
Opcode ID: 670718a24c28732bde16183ce8815a88d955e06398b3d38241fec8cfd8008c94
Instruction ID: eb2f6e0e3133b02300aa4f1c2fe6e69915d36ff06578ba63896efd55e2bc44bf
Opcode Fuzzy Hash: 670718a24c28732bde16183ce8815a88d955e06398b3d38241fec8cfd8008c94
Instruction Fuzzy Hash: 1E428C34208649AFDB20DF28CD44BBABFE5FF89710F100A19F699CB2A1D7359854DB91

Function 005F4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 005F48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 005F4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 005F4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 005F494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 005F495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 005F497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 005F49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 005F49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 005F4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 005F4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 005F4A7E
IsMenu.USER32(?), ref: 005F4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005F4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005F4B20
GetWindowLongW.USER32(?,000000F0), ref: 005F4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 005F4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 005F4C82
wsprintfW.USER32 ref: 005F4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005F4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 005F4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 005F4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005F4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 005F4D5A

Strings

%d/%02d/%02d, xrefs: 005F4CA8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 88f6f10cf9734df6f207066175fb5ada6ab3cbe17da14889348c7efd1535475f
Instruction ID: b90c71db3b8727ea3b99fb63c9d8c17043f4475779711214d26cf9051d101418
Opcode Fuzzy Hash: 88f6f10cf9734df6f207066175fb5ada6ab3cbe17da14889348c7efd1535475f
Instruction Fuzzy Hash: 2F12D071600259ABEB248F28CD49FBF7FA9BF85310F104529FA19DB2A1DB789944CF50

Function 005C1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 005C16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005C170D
Part of subcall function 005C16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005C173A
Part of subcall function 005C16C3: GetLastError.KERNEL32 ref: 005C174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 005C1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 005C12A8
CloseHandle.KERNEL32(?), ref: 005C12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005C12D1
GetProcessWindowStation.USER32 ref: 005C12EA
SetProcessWindowStation.USER32(00000000), ref: 005C12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 005C1310

Part of subcall function 005C10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005C11FC), ref: 005C10D4
Part of subcall function 005C10BF: CloseHandle.KERNEL32(?,?,005C11FC), ref: 005C10E9

Strings

Zb, xrefs: 005C1392
default, xrefs: 005C130B
, xrefs: 005C125A
winsta0, xrefs: 005C12CC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Zb
API String ID: 22674027-1349916648
Opcode ID: cb435881c7a90ea819d42688e3398503a32c8959a0ea9fecbc60997da5b90110
Instruction ID: 9335009c686410cad8d42c49d0e789f970d4f54a547c225d69870303e468877c
Opcode Fuzzy Hash: cb435881c7a90ea819d42688e3398503a32c8959a0ea9fecbc60997da5b90110
Instruction Fuzzy Hash: 5A818571900609AFDF259FA8DD89FAE7FB9FF05700F144169F910E62A2D7348948DB28

Function 005C0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 005C1114
Part of subcall function 005C10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C1120
Part of subcall function 005C10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C112F
Part of subcall function 005C10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C1136
Part of subcall function 005C10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 005C114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005C0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005C0C00
GetLengthSid.ADVAPI32(?), ref: 005C0C17
GetAce.ADVAPI32(?,00000000,?), ref: 005C0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005C0C6D
GetLengthSid.ADVAPI32(?), ref: 005C0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 005C0C8C
HeapAlloc.KERNEL32(00000000), ref: 005C0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 005C0CB4
CopySid.ADVAPI32(00000000), ref: 005C0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005C0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005C0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 005C0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C0D45
HeapFree.KERNEL32(00000000), ref: 005C0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C0D55
HeapFree.KERNEL32(00000000), ref: 005C0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C0D65
HeapFree.KERNEL32(00000000), ref: 005C0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 005C0D78
HeapFree.KERNEL32(00000000), ref: 005C0D7F

Part of subcall function 005C1193: GetProcessHeap.KERNEL32(00000008,005C0BB1,?,00000000,?,005C0BB1,?), ref: 005C11A1
Part of subcall function 005C1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,005C0BB1,?), ref: 005C11A8
Part of subcall function 005C1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,005C0BB1,?), ref: 005C11B7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1fd64ed63722a0a5a1c1c2131adeeee4ac4701191549c8e12e27e0bb1a0387ba
Instruction ID: 10c566c8f1d9901c463c22a8a9f425a95016f9a91ea513339851f7f4e4721925
Opcode Fuzzy Hash: 1fd64ed63722a0a5a1c1c2131adeeee4ac4701191549c8e12e27e0bb1a0387ba
Instruction Fuzzy Hash: 07716B7290020AEFDF109FE4DD48FAEBFB8BF14700F045629E915E6191DB75A909CB60

Function 005DEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(005FCC08), ref: 005DEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 005DEB37
GetClipboardData.USER32(0000000D), ref: 005DEB43
CloseClipboard.USER32 ref: 005DEB4F
GlobalLock.KERNEL32(00000000), ref: 005DEB87
CloseClipboard.USER32 ref: 005DEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 005DEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 005DEBC9
GetClipboardData.USER32(00000001), ref: 005DEBD1
GlobalLock.KERNEL32(00000000), ref: 005DEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 005DEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 005DEC38
GetClipboardData.USER32(0000000F), ref: 005DEC44
GlobalLock.KERNEL32(00000000), ref: 005DEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 005DEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 005DEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 005DECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 005DECF3
CountClipboardFormats.USER32 ref: 005DED14
CloseClipboard.USER32 ref: 005DED59

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 60a73f24d2277c27243f93af2ff454593820e0bbedd73faa4afa35d746f5f0dc
Instruction ID: 5421286ff81a364647a77baba02a4dc6e61928d89975972d8225b61dbcff6c93
Opcode Fuzzy Hash: 60a73f24d2277c27243f93af2ff454593820e0bbedd73faa4afa35d746f5f0dc
Instruction Fuzzy Hash: D5619C342042069FD310EF28C98AE7A7FA4BB95704F14452EF456DB2A1CB35E949DB62

Function 005D698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005D69BE
FindClose.KERNEL32(00000000), ref: 005D6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005D6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005D6A75

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 005D6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 005D6ADF

Strings

%4d, xrefs: 005D6BB1
%03d, xrefs: 005D6DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 005D6B32
%02d, xrefs: 005D6C00, 005D6C0A, 005D6C5A, 005D6CAA, 005D6CFA, 005D6D4A
%4d%02d%02d%02d%02d%02d, xrefs: 005D6B6A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 2d28d4abaf9e7b002c67a5c5d45128fe5243e7fb9f54f212b15161e7887e793a
Instruction ID: 71f653071bc3f267b548902b6fd90f33504fcfab6d9553a3db4e5ffc4517dbdd
Opcode Fuzzy Hash: 2d28d4abaf9e7b002c67a5c5d45128fe5243e7fb9f54f212b15161e7887e793a
Instruction Fuzzy Hash: 7DD14F71508345AAC310EBA4D985EABBBECBFD8704F04491EF589C7291EB74DA44CB62

Function 005D9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 005D9663
GetFileAttributesW.KERNEL32(?), ref: 005D96A1
SetFileAttributesW.KERNEL32(?,?), ref: 005D96BB
FindNextFileW.KERNEL32(00000000,?), ref: 005D96D3
FindClose.KERNEL32(00000000), ref: 005D96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 005D96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 005D974A
SetCurrentDirectoryW.KERNEL32(00626B7C), ref: 005D9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 005D9772
FindClose.KERNEL32(00000000), ref: 005D977F
FindClose.KERNEL32(00000000), ref: 005D978F

Strings

*.*, xrefs: 005D96F5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: a200e2e609bd2d8995b0df360680f5779652b5d2236f837188ef892e174f4caa
Instruction ID: c125709ebdc10ec35988c00f9b532813d1ac3c4d0935a0c443e84c16b7a9f51e
Opcode Fuzzy Hash: a200e2e609bd2d8995b0df360680f5779652b5d2236f837188ef892e174f4caa
Instruction Fuzzy Hash: 7431B33654061D6ADB24AFB8ED08AEE7FACEF49321F104167F915E22A0EB34D944CB50

Function 005D979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 005D97BE
FindNextFileW.KERNEL32(00000000,?), ref: 005D9819
FindClose.KERNEL32(00000000), ref: 005D9824
FindFirstFileW.KERNEL32(*.*,?), ref: 005D9840
SetCurrentDirectoryW.KERNEL32(?), ref: 005D9890
SetCurrentDirectoryW.KERNEL32(00626B7C), ref: 005D98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 005D98B8
FindClose.KERNEL32(00000000), ref: 005D98C5
FindClose.KERNEL32(00000000), ref: 005D98D5

Part of subcall function 005CDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 005CDB00

Strings

*.*, xrefs: 005D983B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 5436fa2b5c61028b64d461f67581f8f817cca8603359768ccaddcbd6983ba2a9
Instruction ID: 825a4e9f6e506e574e151c854edb42649490635c1a9f3ececaf7111f77ca68cc
Opcode Fuzzy Hash: 5436fa2b5c61028b64d461f67581f8f817cca8603359768ccaddcbd6983ba2a9
Instruction Fuzzy Hash: 6C31C63154061D6ADF20AFA8EC48AEE7F6CBF46721F104167E950E2290DB34D949DB50

Function 005EBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005EC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EB6AE,?,?), ref: 005EC9B5
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005EC9F1
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA68
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 005EBFA9
RegCloseKey.ADVAPI32(00000000), ref: 005EBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 005EC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 005EC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 005EC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 005EC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 005EC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 005EC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 005EC382
RegCloseKey.ADVAPI32(00000000), ref: 005EC38F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 3102ba9da1c38ac54ac0132c091b7b3665156c5ed125b64b766cad0a3ebd0e01
Instruction ID: 9d09e9418c6bebf51207143b4afd9a80a89218f1eb8fc615d5be818347bd6054
Opcode Fuzzy Hash: 3102ba9da1c38ac54ac0132c091b7b3665156c5ed125b64b766cad0a3ebd0e01
Instruction Fuzzy Hash: 8C024F716042419FD718CF25C895E2ABFE5BF89314F18889DF48ADB2A2DB31EC46CB51

Function 005D8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005D8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 005D8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005D8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005D8310
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8324
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005D838C
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8395

Strings

*.*, xrefs: 005D839B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 69825bbe25103c17597b20b23fa85cdd0dafcdb63819a6e57264988d3b6b33ea
Instruction ID: 2ef77a87c93f084d3159f1789cbb761b0d2274912f768a543865f7e52974f949
Opcode Fuzzy Hash: 69825bbe25103c17597b20b23fa85cdd0dafcdb63819a6e57264988d3b6b33ea
Instruction Fuzzy Hash: 15617A765043469FC720EF64C8459AEBBE8FF89310F04492EF989D7251EB31E949CB92

Function 005CD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00563A97,?,?,00562E7F,?,?,?,00000000), ref: 00563AC2

Part of subcall function 005CE199: GetFileAttributesW.KERNEL32(?,005CCF95), ref: 005CE19A

FindFirstFileW.KERNEL32(?,?), ref: 005CD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 005CD1DD
MoveFileW.KERNEL32(?,?), ref: 005CD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 005CD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 005CD237

Part of subcall function 005CD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,005CD21C,?,?), ref: 005CD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 005CD253
FindClose.KERNEL32(00000000), ref: 005CD264

Strings

\*.*, xrefs: 005CD0CD, 005CD0D6, 005CD0EB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: ad53bc4e9202db3998a75abba2042e5c955cdb20a7e62a94fb96af800962b595
Instruction ID: 903178dbebdae5f3d995a257ac4094e2d6082461670d86228e057d4e28727467
Opcode Fuzzy Hash: ad53bc4e9202db3998a75abba2042e5c955cdb20a7e62a94fb96af800962b595
Instruction Fuzzy Hash: F061193580110E9ECF05EBE0DA96EEDBBB9BF95300F244169E402B7191EB359F09DB60

Function 005DED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 005DED91
EmptyClipboard.USER32 ref: 005DED97
GlobalAlloc.KERNEL32(00000002,?), ref: 005DEDAC
CloseClipboard.USER32 ref: 005DEEA3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d3a1528275fab8ed811e19fa7e814f5f40d1ec0c9ddafa6fa8f9b7e6a367ab71
Instruction ID: cd4092065705f0ad1559d78d61414230014a48686b19e18d2d65393462ab7ac0
Opcode Fuzzy Hash: d3a1528275fab8ed811e19fa7e814f5f40d1ec0c9ddafa6fa8f9b7e6a367ab71
Instruction Fuzzy Hash: 80417A35204612AFE720EF19D88AB29BFA5FF54318F1480AAE455CF762CB75EC45CB90

Function 005CE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 005C16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005C170D
Part of subcall function 005C16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005C173A
Part of subcall function 005C16C3: GetLastError.KERNEL32 ref: 005C174A

ExitWindowsEx.USER32(?,00000000), ref: 005CE932

Strings

SeShutdownPrivilege, xrefs: 005CE902
, xrefs: 005CE95C
@, xrefs: 005CE925
, xrefs: 005CE920

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: c3a4dc640c2b138f4e22f3bc77aefad8c6459a965ef2b32bf1cbe097270f49c3
Instruction ID: 1781fa51943b03d2d1b3d2f83451f1acb558bcd592c4facf3cac806ce63a0678
Opcode Fuzzy Hash: c3a4dc640c2b138f4e22f3bc77aefad8c6459a965ef2b32bf1cbe097270f49c3
Instruction Fuzzy Hash: 5E012632610215AFEB5422F49C8BFBF7A5CB715740F154929F803E21D2D9B45C848294

Function 005E1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 005E1276
WSAGetLastError.WSOCK32 ref: 005E1283
bind.WSOCK32(00000000,?,00000010), ref: 005E12BA
WSAGetLastError.WSOCK32 ref: 005E12C5
closesocket.WSOCK32(00000000), ref: 005E12F4
listen.WSOCK32(00000000,00000005), ref: 005E1303
WSAGetLastError.WSOCK32 ref: 005E130D
closesocket.WSOCK32(00000000), ref: 005E133C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: bd1e2242ced91501f1fb67f4484e63a08e93d1b42e795ef7c4e5fb73dfc9bd61
Instruction ID: cf8c583aef19b703914c5878e094c04caf9df1fe0f55950d616dbc5ec752218d
Opcode Fuzzy Hash: bd1e2242ced91501f1fb67f4484e63a08e93d1b42e795ef7c4e5fb73dfc9bd61
Instruction Fuzzy Hash: 8D41C135A005419FD714DF25C988B69BFE6BF86318F188098E9968F292C771EC85CBE1

Function 005CD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00563A97,?,?,00562E7F,?,?,?,00000000), ref: 00563AC2

Part of subcall function 005CE199: GetFileAttributesW.KERNEL32(?,005CCF95), ref: 005CE19A

FindFirstFileW.KERNEL32(?,?), ref: 005CD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 005CD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 005CD481
FindClose.KERNEL32(00000000), ref: 005CD498
FindClose.KERNEL32(00000000), ref: 005CD4A1

Strings

\*.*, xrefs: 005CD3F2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 8c454e6a82cf575a0208df295db824834956a1a82854d8c0e1f8a9f17c807cfd
Instruction ID: bd53ec99f1607f886a082843e2479ac03a294be6428022d5d6065b25039e32f5
Opcode Fuzzy Hash: 8c454e6a82cf575a0208df295db824834956a1a82854d8c0e1f8a9f17c807cfd
Instruction Fuzzy Hash: D5316D310083469FC704EFA4D9959AFBFA8BEE1304F444E2DF4D593191EB74AA09DB62

Function 0059E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0059E645

Strings

1#SNAN, xrefs: 0059F844
1#IND, xrefs: 0059F83D
1#INF, xrefs: 0059F852
1#QNAN, xrefs: 0059F84B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f1dbbaf30649ecdf9da16db292f25356d07c799ef1fc004b4bd6d0966f258ab9
Instruction ID: 1a061817357847212dca2e1eeb114fa098929ce715f1df6fabe5506bdb8988fa
Opcode Fuzzy Hash: f1dbbaf30649ecdf9da16db292f25356d07c799ef1fc004b4bd6d0966f258ab9
Instruction Fuzzy Hash: 04C23971E046298BDF25CE28DD457EABBB9FB44304F1445EAD84EE7241E778AE818F40

Function 005D648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D64DC
CoInitialize.OLE32(00000000), ref: 005D6639
CoCreateInstance.OLE32(005FFCF8,00000000,00000001,005FFB68,?), ref: 005D6650
CoUninitialize.OLE32 ref: 005D68D4

Strings

.lnk, xrefs: 005D64BA, 005D6524, 005D65E0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 87ae4519e56e7e0a6b172745e4114074b66bb1c1a33a19ad9945c991255e3346
Instruction ID: 94127e758e2df0b673ff8d424aef73391e561a8730498a5b1b7f84873b9c9f86
Opcode Fuzzy Hash: 87ae4519e56e7e0a6b172745e4114074b66bb1c1a33a19ad9945c991255e3346
Instruction Fuzzy Hash: 48D14B71508202AFD314EF24C88596BBBE8FFD8704F40496EF5958B291DB71ED46CBA2

Function 005E22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 005E22E8

Part of subcall function 005DE4EC: GetWindowRect.USER32(?,?), ref: 005DE504

GetDesktopWindow.USER32 ref: 005E2312
GetWindowRect.USER32(00000000), ref: 005E2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 005E2355
GetCursorPos.USER32(?), ref: 005E2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 005E23DF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 3a4cceb6628dae6cd16a9c90264b6d40a9fb0b000de679638ecb5e136dad4b88
Instruction ID: 9082d031d8f77196f6a9a5917f01b1b32fff3b0e104dd5a8ea2cde25b57285cc
Opcode Fuzzy Hash: 3a4cceb6628dae6cd16a9c90264b6d40a9fb0b000de679638ecb5e136dad4b88
Instruction Fuzzy Hash: 5F31BE72505359AFC724DF55C849F6BBBAAFB88310F000919F985D7181DA34E908CB92

Function 005D9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 005D9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 005D9C8B

Part of subcall function 005D3874: GetInputState.USER32 ref: 005D38CB
Part of subcall function 005D3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005D3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 005D9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 005D9C75

Strings

*.*, xrefs: 005D9B5D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: b7c5afe5c0cd408378d3522aa15718330d28033c01f237235bd70d71ff7f0695
Instruction ID: f03da3ec677a6f924602bf2b350ac4c2fa34a3a29661952bd14e98003e92bcaf
Opcode Fuzzy Hash: b7c5afe5c0cd408378d3522aa15718330d28033c01f237235bd70d71ff7f0695
Instruction Fuzzy Hash: 27415E7190420A9BDF24DF68C949AEE7FB8FF55310F244467E805A32A1EB309E44DF61

Function 0057997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00579A4E
GetSysColor.USER32(0000000F), ref: 00579B23
SetBkColor.GDI32(?,00000000), ref: 00579B36

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 6219f5e035c3965872febf28260673128b1386df43f75b1e88c08f068655119b
Instruction ID: 3ecbbc0f0acff0c104d72a748f2ddc641d78a8514b56a6703bf2987be54ed828
Opcode Fuzzy Hash: 6219f5e035c3965872febf28260673128b1386df43f75b1e88c08f068655119b
Instruction Fuzzy Hash: 23A13A70109418AEE728AE3DAC5CEBB2E5DFBC6300F258509F106CA6D5CA25AD01E372

Function 005E1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 005E304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 005E307A
Part of subcall function 005E304E: _wcslen.LIBCMT ref: 005E309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 005E185D
WSAGetLastError.WSOCK32 ref: 005E1884
bind.WSOCK32(00000000,?,00000010), ref: 005E18DB
WSAGetLastError.WSOCK32 ref: 005E18E6
closesocket.WSOCK32(00000000), ref: 005E1915

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: dc454a4c85567a35ff8965434e8d17e0a959b9d068f12171351a233f52cb326c
Instruction ID: d79d8d1a7a8f81db06ece7dc2188e00dbd30255e59d5ddac0a0d6318c3466651
Opcode Fuzzy Hash: dc454a4c85567a35ff8965434e8d17e0a959b9d068f12171351a233f52cb326c
Instruction Fuzzy Hash: DF51B475A002019FDB14AF24C88AF6A7FE5BB84718F088498F9469F3D3D771AD41CBA1

Function 005F1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 005F1CC0
IsWindowEnabled.USER32 ref: 005F1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 005F1CDB
IsIconic.USER32 ref: 005F1CE9
IsZoomed.USER32 ref: 005F1CF7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: bf2f3699e956af4c6e496855bf9e7924dd84d66931b19f52e6cb6a05673be657
Instruction ID: 5c5e89e551cb89bc69af6c6ff233faff521d39560bcb4c2bf3c85a0f9610a5fb
Opcode Fuzzy Hash: bf2f3699e956af4c6e496855bf9e7924dd84d66931b19f52e6cb6a05673be657
Instruction Fuzzy Hash: 6E21A031740A099FD7208F2AC844B3A7FA5BF95324B188468E946CB351CB79EC46CB98

Function 00568060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0056813C
VUUU, xrefs: 005A5DF0
VUUU, xrefs: 005683FA
VUUU, xrefs: 0056843C
VUUU, xrefs: 005683E8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 56251b50aea9293fdbf0657b47aa1c180695a39b65da558a9c670396409c901d
Instruction ID: 0fba2633607a2656a34db8a07356923c57f0d5a1735183d685799b79d0651056
Opcode Fuzzy Hash: 56251b50aea9293fdbf0657b47aa1c180695a39b65da558a9c670396409c901d
Instruction Fuzzy Hash: E8A28174E0061ACBDF24CF58C8547BDBBB1BF55314F2486AAE815A7285EB709D81CF90

Function 005C8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 005C82AA

Strings

|, xrefs: 005C82DA
tbb, xrefs: 005C84F4
(, xrefs: 005C82F0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tbb$|
API String ID: 1659193697-2205570525
Opcode ID: cf472f5374959be09ba9923fdb919d3fee652b259fed729be35663677b5515cd
Instruction ID: bfdcd8bde9808145f4e0ffc87cfd699a647111b4d67994d1758ebc2723609d80
Opcode Fuzzy Hash: cf472f5374959be09ba9923fdb919d3fee652b259fed729be35663677b5515cd
Instruction Fuzzy Hash: C5322674A006059FCB28CF59C481E6ABBF0FF48710B15C96EE59ADB7A1EB70E941CB44

Function 005EA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005EA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 005EA6BA

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Process32NextW.KERNEL32(00000000,?), ref: 005EA79C
CloseHandle.KERNEL32(00000000), ref: 005EA7AB

Part of subcall function 0057CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,005A3303,?), ref: 0057CE8A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: bc1de0a075c26c55e0bf0387d4e796fc47a5b8fa763e48b4325e477ad9e34f91
Instruction ID: 74ca0802c5b97e905c0e3fa57b291bac6c1c2306be395dccfb3303b011d17f20
Opcode Fuzzy Hash: bc1de0a075c26c55e0bf0387d4e796fc47a5b8fa763e48b4325e477ad9e34f91
Instruction Fuzzy Hash: F1513A715083419FD714EF25C88AA6BBBE8FFD9754F00892DF58997291EB30E904CB92

Function 005CAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 005CAAAC
SetKeyboardState.USER32(00000080), ref: 005CAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 005CAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 005CAB88

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 74064e8c035e0f6a1e68ccee6b39b7b7ca60847d91792b359a53230126f6a9e0
Instruction ID: 7b4ab838cf8a823cf7653ba927656f9afc15adcc477f62ba7deb31511a2f2b85
Opcode Fuzzy Hash: 74064e8c035e0f6a1e68ccee6b39b7b7ca60847d91792b359a53230126f6a9e0
Instruction Fuzzy Hash: D031F370A4024CAEFB258AA8CC09FFA7FAABB94318F04421EF181961D1D7758D85D762

Function 0059BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0059BB7F

Part of subcall function 005929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000), ref: 005929DE
Part of subcall function 005929C8: GetLastError.KERNEL32(00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000,00000000), ref: 005929F0

GetTimeZoneInformation.KERNEL32 ref: 0059BB91
WideCharToMultiByte.KERNEL32(00000000,?,0063121C,000000FF,?,0000003F,?,?), ref: 0059BC09
WideCharToMultiByte.KERNEL32(00000000,?,00631270,000000FF,?,0000003F,?,?,?,0063121C,000000FF,?,0000003F,?,?), ref: 0059BC36

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: b353b2f9c660b7f1dab6a79a774ad613b39582936089a39321115c0bca952733
Instruction ID: 5f8c610d07481ed277de90c01b9993496d9c32451a7e812c25bda67d85ed782e
Opcode Fuzzy Hash: b353b2f9c660b7f1dab6a79a774ad613b39582936089a39321115c0bca952733
Instruction Fuzzy Hash: 3331C170904206DFEF10DF69ED8092EBFBAFF56310B14566AE010DB2A1D7309E80CB90

Function 005DCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 005DCE89
GetLastError.KERNEL32(?,00000000), ref: 005DCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 005DCEFE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: df06d4ea8354a2b7e6a0418e10aebb43a526924e0c17ef976b7a513ca66b8bfe
Instruction ID: e9e71278b963e9fff4ae19667500017ee16b1d7342436fafe483b891b77836a2
Opcode Fuzzy Hash: df06d4ea8354a2b7e6a0418e10aebb43a526924e0c17ef976b7a513ca66b8bfe
Instruction Fuzzy Hash: FC21ACB15003069BEB319FA9C949BAA7FFCFB50354F10482FE546E2251E774EA48DB60

Function 005D5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005D5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 005D5D17
FindClose.KERNEL32(?), ref: 005D5D5F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 6e16935a7ac01db09885e8b38363ad2734f3a186ebe697f34c2c4d12ba05775e
Instruction ID: f2b3e03d39828be93f8af2ed8d54faafe930afe8da1f5190703401cd3018b5bd
Opcode Fuzzy Hash: 6e16935a7ac01db09885e8b38363ad2734f3a186ebe697f34c2c4d12ba05775e
Instruction Fuzzy Hash: 6F518C746046029FC724DF28C498E96BBE5FF49314F14855EE99A8B3A1DB30ED44CFA1

Function 00592622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0059271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00592724
UnhandledExceptionFilter.KERNEL32(?), ref: 00592731

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d1257cd9cb6a392b7e6620d006f4d78d9e23925f59c5f08cf81019f225b24b8b
Instruction ID: 7597a224e4e54f1b9a5236920b62d1971e3cd83f557029c3c464b5687446c37d
Opcode Fuzzy Hash: d1257cd9cb6a392b7e6620d006f4d78d9e23925f59c5f08cf81019f225b24b8b
Instruction Fuzzy Hash: E031C67490121DABCB21DF64DD8979CBBB8BF18310F5055EAE81CA6260E7349F858F44

Function 005D51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 005D5238
SetErrorMode.KERNEL32(00000000), ref: 005D52A1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9de5a9aa805cdb648d28ce3e813fabf14d19b151b828d07b7896c21b7e7220f0
Instruction ID: 34f113f256e078fa86bc59647cf9577c4f9c0a1d08a55ff3315802ed1511e238
Opcode Fuzzy Hash: 9de5a9aa805cdb648d28ce3e813fabf14d19b151b828d07b7896c21b7e7220f0
Instruction Fuzzy Hash: 52315075A00519DFDB00DF94D888EADBFB4FF48314F048099E8459B352DB35E859CB90

Function 005C16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0057FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00580668
Part of subcall function 0057FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00580685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005C170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005C173A
GetLastError.KERNEL32 ref: 005C174A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: e42acf9fdb5bb84c13d251bd7ab577fad78d8d14a6e6bc1266525e4978bc9230
Instruction ID: bb9387e43b47e420dbf3fb7250391243144a28cef11879da69b60701329106cd
Opcode Fuzzy Hash: e42acf9fdb5bb84c13d251bd7ab577fad78d8d14a6e6bc1266525e4978bc9230
Instruction Fuzzy Hash: 6E11B2B1400209BFD718DF54EC8AE6ABBFDFB44754B20852EE05696241EB70BC41CB24

Function 005CD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005CD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 005CD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005CD650

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: db8a46d766f96e028a9897f6033b792ef277405e5456f7a08401df3cb3fd469b
Instruction ID: dcf9bba62f0e631e921d54490c6a627201bba7ed8f9856e59a23851f8d46a37d
Opcode Fuzzy Hash: db8a46d766f96e028a9897f6033b792ef277405e5456f7a08401df3cb3fd469b
Instruction Fuzzy Hash: C9117C75E01228BFDB108F989C44FAFBFBCEB45B50F108126F904E7290C2704A05DBA1

Function 005C1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 005C168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005C16A1
FreeSid.ADVAPI32(?), ref: 005C16B1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6f98e986a48d19e48a2e0a8e4695390022c87f5f924ed9816e1bfbc0a2197889
Instruction ID: 00ebc2491613621201d0cd45af534599975c896f4acc2183e46aa683ebbbee41
Opcode Fuzzy Hash: 6f98e986a48d19e48a2e0a8e4695390022c87f5f924ed9816e1bfbc0a2197889
Instruction Fuzzy Hash: 9EF0F47195030DFBDB00DFE49D89EAEBBBCFB08604F504965E501E2181E774AA48AA54

Function 00584CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(005928E9,?,00584CBE,005928E9,006288B8,0000000C,00584E15,005928E9,00000002,00000000,?,005928E9), ref: 00584D09
TerminateProcess.KERNEL32(00000000,?,00584CBE,005928E9,006288B8,0000000C,00584E15,005928E9,00000002,00000000,?,005928E9), ref: 00584D10
ExitProcess.KERNEL32 ref: 00584D22

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 740485a4d4d9ae1760906f2cee842862ea46a429a3bd84ec3b802a145f5c4c63
Instruction ID: 8b85fe3951a71e54d288c6b393b7d883b5c9bbcb7d270c3d601ecdfd36b59ab8
Opcode Fuzzy Hash: 740485a4d4d9ae1760906f2cee842862ea46a429a3bd84ec3b802a145f5c4c63
Instruction Fuzzy Hash: 67E0B631001149ABCF12BF54DE09E687F6AFB91781B104424FC05DA162CB39ED56EF80

Function 005BD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005BD28C

Strings

X64, xrefs: 005BD2A8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: cdeff756374b01dc674327ead1c4036eeceeb1afc31a590e7a2e5625035a182c
Instruction ID: 28e05eb710402fdd78c7d23ca453cf8f4100b8cd549a738c1e126c2ff39924cd
Opcode Fuzzy Hash: cdeff756374b01dc674327ead1c4036eeceeb1afc31a590e7a2e5625035a182c
Instruction Fuzzy Hash: 46D0C9B880111DEACB94CB90EC8CDDDBB7CBF14305F104955F506E2000EB3495499F20

Function 0058CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 47c32353fd823e7d910e9f37d6584708a9ad1ec7d647cf74ab01d597e004a4a7
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 59020A71E012199BDF14DFA9C8806ADBFB5FF88314F25816AD919BB280D731AE418B94

Function 0056CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

`g, xrefs: 0056CF7F
Variable is not of type 'Object'., xrefs: 005B0C40

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$`g
API String ID: 0-877891039
Opcode ID: 2be8956dd2894b2b287cc3482ef5cec8069d54ea18461fb1fa0d911457f70ea0
Instruction ID: cfbbacc07a64fb662f902c2070f298c9d8bec35272f18ea7af2191c170adaeed
Opcode Fuzzy Hash: 2be8956dd2894b2b287cc3482ef5cec8069d54ea18461fb1fa0d911457f70ea0
Instruction Fuzzy Hash: 89329C70900219DFDF14DF90C889AFEBFB9BF45304F148469E846AB292DB75AE45CB60

Function 005D68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005D6918
FindClose.KERNEL32(00000000), ref: 005D6961

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 41d248ad4181da6f0b4aa43bc67c1062fd2e61caee324ea69ac13425996ef280
Instruction ID: 017ababff6a936b008088b4b4a6a4dbd5d1ad807fd27b7a792303da22089576a
Opcode Fuzzy Hash: 41d248ad4181da6f0b4aa43bc67c1062fd2e61caee324ea69ac13425996ef280
Instruction Fuzzy Hash: F21196355042019FC710DF69D488A25BFE5FF85328F14C59AE4698F3A2C734EC05CB91

Function 005D37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,005E4891,?,?,00000035,?), ref: 005D37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,005E4891,?,?,00000035,?), ref: 005D37F4

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: aa3270b992224cd90ab7c0e3a49cf634fe29314bce80885dc8e04675c9512c49
Instruction ID: ddfa9e1f3889981e0bc750e80ff5f486e376c646ad76621511a113aaaca2f694
Opcode Fuzzy Hash: aa3270b992224cd90ab7c0e3a49cf634fe29314bce80885dc8e04675c9512c49
Instruction Fuzzy Hash: 50F0E5B460522A2AE720576A8C4DFEB3FAEFFC5761F000176F509E22C1D9609E08C6B1

Function 005C10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005C11FC), ref: 005C10D4
CloseHandle.KERNEL32(?,?,005C11FC), ref: 005C10E9

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0645ed87855cb7aff3678cabc50f5e8670a7710a58f98289b415c8e58826f2f6
Instruction ID: 1ee7e06b630260e41be95c9663a7d983582d4d0877b59dcef23a1bdca0ff134f
Opcode Fuzzy Hash: 0645ed87855cb7aff3678cabc50f5e8670a7710a58f98289b415c8e58826f2f6
Instruction Fuzzy Hash: 29E04F32018601AFE7256B51FC09E777FADFF04310B10C82DF4A5804B1DB626C90EB14

Function 0056BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

`g, xrefs: 005B07CE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: `g
API String ID: 3964851224-2379392305
Opcode ID: 303c091257a46a91e92731876c017f34c824289007b0d85c41948d08549ddaf4
Instruction ID: 0e26d86e0ec3d29d00ca305b62fbabaeb44202147fed8b596d9d012861138a0f
Opcode Fuzzy Hash: 303c091257a46a91e92731876c017f34c824289007b0d85c41948d08549ddaf4
Instruction Fuzzy Hash: 9EA258706083419FD724DF28C484B6ABFE1BF89304F14996DE89A9B392D771EC45CB92

Function 0059676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00596766,?,?,00000008,?,?,0059FEFE,00000000), ref: 00596998

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b75a8566b995cc26962c5d33435c36413f2bc17ac65a7d7d9f7686fd844bcfd5
Instruction ID: f290c1621d5b1878234d15546ea3b1ea6f5fa6b237029adcda1becdfe6b25c76
Opcode Fuzzy Hash: b75a8566b995cc26962c5d33435c36413f2bc17ac65a7d7d9f7686fd844bcfd5
Instruction Fuzzy Hash: CFB13C31610609DFDB19CF28C48AB657FE0FF45364F298658E899CF2A2C735E999CB40

Function 0057B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 005B851F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 293a61c3bfa38a9e7c3475b0f3ff76dbe5cf1b73173d76bce3a3c084f82bf6d4
Instruction ID: f200f0d11f9f4b6ac37e3ccec334eeeb0ef1ed15595bd5706feb5bc125674101
Opcode Fuzzy Hash: 293a61c3bfa38a9e7c3475b0f3ff76dbe5cf1b73173d76bce3a3c084f82bf6d4
Instruction Fuzzy Hash: 14125E759002299BDF24CF58D880BFEBBF5FF48310F14859AE849EB251DB349A81DB90

Function 005DEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 005DEABD

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d83414557d4b48e496c99bf68e5ee33787ea3455850334672cebd41a5bbe805f
Instruction ID: 1aa5ceb6879c270f70a7f780698c131ea0a3f2e4d846cf70f2e9dfac8dcf6e67
Opcode Fuzzy Hash: d83414557d4b48e496c99bf68e5ee33787ea3455850334672cebd41a5bbe805f
Instruction Fuzzy Hash: 7DE012312002059FD710EF5DD409D9AFFD9BF98760F008417FC45CB351DA70A8448B90

Function 005809D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,005803EE), ref: 005809DA

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92bec30c29c4bdc9a9d5a64b179cf9297f6403cfcd329947352a0f74ae3bd743
Instruction ID: e85502bc04bd27619ad472ad130d5528617815a920a38cd9b7dddf2cac70b683
Opcode Fuzzy Hash: 92bec30c29c4bdc9a9d5a64b179cf9297f6403cfcd329947352a0f74ae3bd743
Instruction Fuzzy Hash:

Function 0058781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0058798B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: f6cf0209becef70c617aad0dfb93ca33fa4737355dcca03d10b85fdd0ddf0eaa
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 6751897160C60E5BDB38B528889E7BE2F89FB5E340F380909DC86F7282D611DE01DB56

Function 005D2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&c, xrefs: 005D2053

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: 0&c
API String ID: 0-3427766084
Opcode ID: 4a3dfd4a03f5614619b681d6ef2288fc8dda2728f8c4017a5decff9dacb86b70
Instruction ID: b69f1144cdb8f5944b4037b1cdcb5a5e3544cc79385261d99ee9dbafda71bc6c
Opcode Fuzzy Hash: 4a3dfd4a03f5614619b681d6ef2288fc8dda2728f8c4017a5decff9dacb86b70
Instruction Fuzzy Hash: 7C21A5326606118BDB28CE79C82767A77E5BB64320F15862EE4A7C37D0DE35A904CB80

Function 00596DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbae2519736f17fce8278f58f4e3e8370cd46926af4da7785abe43f7c7d234ba
Instruction ID: 14bf392a21a4d8ff89feb1c5c2d70a5e8da26cb469b811a0355bb0685afb3765
Opcode Fuzzy Hash: dbae2519736f17fce8278f58f4e3e8370cd46926af4da7785abe43f7c7d234ba
Instruction Fuzzy Hash: 02321421D79F054DDB239634CC363366A89BFBB3C5F15D727E81AB59A6EB29C4834100

Function 0057CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5977d8081f626e64b3cc539c606531d613d3e717af7ea56e946114860708a6
Instruction ID: 99882bc663c74bb954ee7867d0fdf08e5296476e0fbd8e3ebc6ada10812c8326
Opcode Fuzzy Hash: 7f5977d8081f626e64b3cc539c606531d613d3e717af7ea56e946114860708a6
Instruction Fuzzy Hash: 45320331A001558BDF39CF28D4A46FD7FA5FB45300F28856AD8AACB691D734ED81EB48

Function 00567920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf394e8960a3024467846657fb2dbd58b5a0c14fd327491b5a86559e0ccb1b9
Instruction ID: faa04e0677495072e372c249a38dc3c124b3ecc9d3ce08f93faf5bfe24001e4a
Opcode Fuzzy Hash: abf394e8960a3024467846657fb2dbd58b5a0c14fd327491b5a86559e0ccb1b9
Instruction Fuzzy Hash: 9A22E470A0060ADFDF14CFA4D845AAEBBF6FF49304F204529E816A7291FB359D15CB50

Function 005691C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5ee721b3ba364669148546acbc4b77999cd8de7d813e67dcddb89bfa5e2fb8
Instruction ID: c3a64ba2d55e62c0a5816d011cddc38db92f85c3e7fc22f2795daea1d73ebc4a
Opcode Fuzzy Hash: 7c5ee721b3ba364669148546acbc4b77999cd8de7d813e67dcddb89bfa5e2fb8
Instruction Fuzzy Hash: 9C02C8B0A0010AEFDB14DF54D895AAEBFB5FF45300F108569E806DB391E7319E11DB91

Function 00599EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed33c208cc93dfe5dbb674d35115bf219bbdc6501507951aa39e750a8ac9963e
Instruction ID: 9d6314908a87e4c5a8aa33248803cb9606eaf0e238eb0207b9d74f8e730e2a57
Opcode Fuzzy Hash: ed33c208cc93dfe5dbb674d35115bf219bbdc6501507951aa39e750a8ac9963e
Instruction Fuzzy Hash: 22B11420D6AF904DC72796398871337BA4DAFBB2D6F91E71BFC1674E22EB2185834140

Function 00581C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 1c56c4f06a01e28f755ad8b205fe37842f009a23249811806e4f777226717231
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: CE91B8722094A34ADB29563E853413EFFE97A923A131A079DDCF3EA1C1FE10C955D724

Function 00581F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 97aaa1dc45933676427545ce001b3f68f24ddf09d3c1d340004788040408e42a
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 009198722094A34EDB6D523A847803EFFE17A923A171A079DDCF2EB1C5EE24C555E720

Function 005819B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 7deaf158b9242fd92ec0eafe47c11f57683b6c262a988b06576594136b727b84
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 8491D6722098E34ADB2D527A847403DFFE96A923A231A079ED8F3EA1C1FD14C556D724

Function 00587A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071f4141b6bb03ac14a966e41379fcc4b539d71006698894dd1c5f60a1614e1c
Instruction ID: d84b351c9a9c81ea86db24edc2d861544ad86d31d842f82ec0b1b6cfea0b49d4
Opcode Fuzzy Hash: 071f4141b6bb03ac14a966e41379fcc4b539d71006698894dd1c5f60a1614e1c
Instruction Fuzzy Hash: 4D61497130870E56DA38B9288899BBE6F96FF9D701F740D19EC42FB281EA11DE428355

Function 00587CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68abce483c82a999aa2766e38b862b86b224ec0b1659dee56a539a2b82458c8
Instruction ID: 7d39b6106f5a87f0b898ddc135110b5a8f52a3b1de356ffa7249e0fb5710b532
Opcode Fuzzy Hash: b68abce483c82a999aa2766e38b862b86b224ec0b1659dee56a539a2b82458c8
Instruction Fuzzy Hash: 2D617B3120870E96DA3879384855BBE2F88FF9E744F741959EC43FB281EA12ED418355

Function 00581706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: b49397647a1f3364338b6ac55aa9984c4bbeca859afc824a0f70f4b8aa110673
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 8881A6336084A30DDB2D523A853547EFFE5BA923A131A079DD8F2DB1C1EE24C556EB24

Function 005E2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 005E2B30
DeleteObject.GDI32(00000000), ref: 005E2B43
DestroyWindow.USER32 ref: 005E2B52
GetDesktopWindow.USER32 ref: 005E2B6D
GetWindowRect.USER32(00000000), ref: 005E2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 005E2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 005E2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2CF8
GetClientRect.USER32(00000000,?), ref: 005E2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005E2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2DA8
GlobalFree.KERNEL32(00000000), ref: 005E2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,005FFC38,00000000), ref: 005E2DDB
GlobalFree.KERNEL32(00000000), ref: 005E2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 005E2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 005E2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E303F

Strings

DISPLAY, xrefs: 005E2EA2
AutoIt v3, xrefs: 005E2CF2
static, xrefs: 005E2D3A, 005E2E91
, xrefs: 005E2FC5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: c15eecdde1dc21554be2988f0c4dd9d074781f637056fbebca31ec44b6ca970d
Instruction ID: 57b5a9fd63eb8347bff8c64b23fc1d886de6269de3b4f4c187c3d150e5656ccd
Opcode Fuzzy Hash: c15eecdde1dc21554be2988f0c4dd9d074781f637056fbebca31ec44b6ca970d
Instruction Fuzzy Hash: E3028A71900209AFDB18DFA4CD89EAE7FB9FB49310F008158F915EB2A1DB74AD45CB60

Function 005F70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 005F712F
GetSysColorBrush.USER32(0000000F), ref: 005F7160
GetSysColor.USER32(0000000F), ref: 005F716C
SetBkColor.GDI32(?,000000FF), ref: 005F7186
SelectObject.GDI32(?,?), ref: 005F7195
InflateRect.USER32(?,000000FF,000000FF), ref: 005F71C0
GetSysColor.USER32(00000010), ref: 005F71C8
CreateSolidBrush.GDI32(00000000), ref: 005F71CF
FrameRect.USER32(?,?,00000000), ref: 005F71DE
DeleteObject.GDI32(00000000), ref: 005F71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 005F7230
FillRect.USER32(?,?,?), ref: 005F7262
GetWindowLongW.USER32(?,000000F0), ref: 005F7284

Part of subcall function 005F73E8: GetSysColor.USER32(00000012), ref: 005F7421
Part of subcall function 005F73E8: SetTextColor.GDI32(?,?), ref: 005F7425
Part of subcall function 005F73E8: GetSysColorBrush.USER32(0000000F), ref: 005F743B
Part of subcall function 005F73E8: GetSysColor.USER32(0000000F), ref: 005F7446
Part of subcall function 005F73E8: GetSysColor.USER32(00000011), ref: 005F7463
Part of subcall function 005F73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 005F7471
Part of subcall function 005F73E8: SelectObject.GDI32(?,00000000), ref: 005F7482
Part of subcall function 005F73E8: SetBkColor.GDI32(?,00000000), ref: 005F748B
Part of subcall function 005F73E8: SelectObject.GDI32(?,?), ref: 005F7498
Part of subcall function 005F73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 005F74B7
Part of subcall function 005F73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005F74CE
Part of subcall function 005F73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 005F74DB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: de69bd006319ffc1f18b94beaa050d871d0bd55b2197cf58e3d58ab855df2a5f
Instruction ID: 5469a52511452a152527ea4eb49fbf0a12db6a7dfd69bf69384a4956e735dcf7
Opcode Fuzzy Hash: de69bd006319ffc1f18b94beaa050d871d0bd55b2197cf58e3d58ab855df2a5f
Instruction Fuzzy Hash: B7A19172008309AFD7009F64DD48E7B7FA9FB59320F100A29FA62D61E1D779E948DB51

Function 00578D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00578E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 005B6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 005B6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 005B6F43

Part of subcall function 00578F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00578BE8,?,00000000,?,?,?,?,00578BBA,00000000,?), ref: 00578FC5

SendMessageW.USER32(?,00001053), ref: 005B6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 005B6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 005B6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 005B6FB7

Strings

0, xrefs: 005B6DCF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: ca8e4a5a5e7ae2c484e243f3b42bd78b294af881af713d85f35db259b9a3914b
Instruction ID: 6b60a4e5d0a0f04641c8458a65ad415fb52055ee9a9f9d2594ed061ddb8afb44
Opcode Fuzzy Hash: ca8e4a5a5e7ae2c484e243f3b42bd78b294af881af713d85f35db259b9a3914b
Instruction Fuzzy Hash: 6912AC30604201DFDB25CF24D958BBABFAAFB45300F148469E489CB261CB39FC56EB91

Function 005E2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 005E273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 005E286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 005E28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 005E28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 005E2900
GetClientRect.USER32(00000000,?), ref: 005E290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 005E2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 005E2964
GetStockObject.GDI32(00000011), ref: 005E2974
SelectObject.GDI32(00000000,00000000), ref: 005E2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 005E2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 005E2991
DeleteDC.GDI32(00000000), ref: 005E299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 005E29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 005E29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 005E2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 005E2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 005E2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 005E2A77
GetStockObject.GDI32(00000011), ref: 005E2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 005E2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 005E2A97

Strings

DISPLAY, xrefs: 005E295A
AutoIt v3, xrefs: 005E28F8
msctls_progress32, xrefs: 005E2A13
static, xrefs: 005E294F, 005E2A71

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4f4d2c17d2b2af3825992e812014fc18365f95bc8969d8990688c61fa6a6a255
Instruction ID: 89a2b303318fc5609b1ad00b145725dda3fbcb38ef2a419f0b84d8c673815301
Opcode Fuzzy Hash: 4f4d2c17d2b2af3825992e812014fc18365f95bc8969d8990688c61fa6a6a255
Instruction Fuzzy Hash: 2AB16D71A00219AFEB14DFA8CD49FAE7BA9FB49710F004155F915EB2A0D774ED40CBA0

Function 005D4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D4AED
GetDriveTypeW.KERNEL32(?,005FCB68,?,\\.\,005FCC08), ref: 005D4BCA
SetErrorMode.KERNEL32(00000000,005FCB68,?,\\.\,005FCC08), ref: 005D4D36

Strings

1394, xrefs: 005D4C9F
\\.\, xrefs: 005D4B3F
Network, xrefs: 005D4C02
Virtual, xrefs: 005D4CE5
Fibre, xrefs: 005D4CAD
SSA, xrefs: 005D4CA6
SATA, xrefs: 005D4CD0
SSD, xrefs: 005D4C4A
RAMDisk, xrefs: 005D4BF4
SAS, xrefs: 005D4CC9
USB, xrefs: 005D4CB4
SCSI, xrefs: 005D4C8A
Unknown, xrefs: 005D4BED, 005D4C83
ATAPI, xrefs: 005D4C91
CDROM, xrefs: 005D4BFB
PhysicalDrive, xrefs: 005D4B76
RAID, xrefs: 005D4CBB
ATA, xrefs: 005D4C98
MMC, xrefs: 005D4CDE
Removable, xrefs: 005D4C10, 005D4C15
iSCSI, xrefs: 005D4CC2
Fixed, xrefs: 005D4C09
FileBackedVirtual, xrefs: 005D4CEC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 0ab9c4a2f56334096cfc847f9f7fc4f6d292a9d9c7acd64b718eee3f086fc302
Instruction ID: 3bd146b491014b880a3fd5c84b8d2b0818d9306653c21b099972e9e6bdfc1881
Opcode Fuzzy Hash: 0ab9c4a2f56334096cfc847f9f7fc4f6d292a9d9c7acd64b718eee3f086fc302
Instruction Fuzzy Hash: E261903071650A9BCB24EF28DA859797FB2BF44304B248827F806AB7A1DB35ED41DF51

Function 005F73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 005F7421
SetTextColor.GDI32(?,?), ref: 005F7425
GetSysColorBrush.USER32(0000000F), ref: 005F743B
GetSysColor.USER32(0000000F), ref: 005F7446
CreateSolidBrush.GDI32(?), ref: 005F744B
GetSysColor.USER32(00000011), ref: 005F7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 005F7471
SelectObject.GDI32(?,00000000), ref: 005F7482
SetBkColor.GDI32(?,00000000), ref: 005F748B
SelectObject.GDI32(?,?), ref: 005F7498
InflateRect.USER32(?,000000FF,000000FF), ref: 005F74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005F74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 005F74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005F752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 005F7554
InflateRect.USER32(?,000000FD,000000FD), ref: 005F7572
DrawFocusRect.USER32(?,?), ref: 005F757D
GetSysColor.USER32(00000011), ref: 005F758E
SetTextColor.GDI32(?,00000000), ref: 005F7596
DrawTextW.USER32(?,005F70F5,000000FF,?,00000000), ref: 005F75A8
SelectObject.GDI32(?,?), ref: 005F75BF
DeleteObject.GDI32(?), ref: 005F75CA
SelectObject.GDI32(?,?), ref: 005F75D0
DeleteObject.GDI32(?), ref: 005F75D5
SetTextColor.GDI32(?,?), ref: 005F75DB
SetBkColor.GDI32(?,?), ref: 005F75E5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 8b87078805bfc15040f7758c442d4a71bd7c025a7bca893588e17793968edb47
Instruction ID: 9aaed6180e32280b326dc7d0d7fa891a6065f650bd3a92a90d26a08bccef617a
Opcode Fuzzy Hash: 8b87078805bfc15040f7758c442d4a71bd7c025a7bca893588e17793968edb47
Instruction Fuzzy Hash: 9F61597290421CAFDF019FA4DD49EEEBFB9FB08320F104525FA15EB2A1D6789944DB90

Function 005F0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 005F1128
GetDesktopWindow.USER32 ref: 005F113D
GetWindowRect.USER32(00000000), ref: 005F1144
GetWindowLongW.USER32(?,000000F0), ref: 005F1199
DestroyWindow.USER32(?), ref: 005F11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 005F11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 005F121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 005F1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 005F1245
IsWindowVisible.USER32(00000000), ref: 005F12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 005F12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 005F12D0
GetWindowRect.USER32(00000000,?), ref: 005F12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 005F130E
GetMonitorInfoW.USER32(00000000,?), ref: 005F1328
CopyRect.USER32(?,?), ref: 005F133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 005F13AA

Strings

tooltips_class32, xrefs: 005F11E6
0, xrefs: 005F10D3
(, xrefs: 005F131B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6efc9b840c8679271aaa735ea00738da8cccdbf9595650effc30118fd6b16ec7
Instruction ID: 1de7a0ba5f9ec2b539f39d8bd840b66fabb80a2e8ebf0fd0dff7170f1a25564a
Opcode Fuzzy Hash: 6efc9b840c8679271aaa735ea00738da8cccdbf9595650effc30118fd6b16ec7
Instruction Fuzzy Hash: 2EB18A71608745EFD700DF64C988A6ABFE4FF84310F008918FA9ADB2A1DB75E844CB95

Function 00578891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00578968
GetSystemMetrics.USER32(00000007), ref: 00578970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0057899B
GetSystemMetrics.USER32(00000008), ref: 005789A3
GetSystemMetrics.USER32(00000004), ref: 005789C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005789E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 005789F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00578A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00578A3C
GetClientRect.USER32(00000000,000000FF), ref: 00578A5A
GetStockObject.GDI32(00000011), ref: 00578A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00578A81

Part of subcall function 0057912D: GetCursorPos.USER32(?), ref: 00579141
Part of subcall function 0057912D: ScreenToClient.USER32(00000000,?), ref: 0057915E
Part of subcall function 0057912D: GetAsyncKeyState.USER32(00000001), ref: 00579183
Part of subcall function 0057912D: GetAsyncKeyState.USER32(00000002), ref: 0057919D

SetTimer.USER32(00000000,00000000,00000028,005790FC), ref: 00578AA8

Strings

AutoIt v3 GUI, xrefs: 00578A20

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: e2079556310a352494fe583460c406b7d625cfde2705ef4783ba77d0ea6cd0b1
Instruction ID: bc1af5e4106c03b1fa3a2a8af2654f854b7a90dde154aeaafe8a79bd02ae838b
Opcode Fuzzy Hash: e2079556310a352494fe583460c406b7d625cfde2705ef4783ba77d0ea6cd0b1
Instruction Fuzzy Hash: 93B15C71A4020A9FDB14DF68DD49BBE7FB5FB48314F108129FA19EB290DB34A840DB51

Function 005C0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 005C1114
Part of subcall function 005C10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C1120
Part of subcall function 005C10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C112F
Part of subcall function 005C10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C1136
Part of subcall function 005C10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 005C114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005C0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005C0E29
GetLengthSid.ADVAPI32(?), ref: 005C0E40
GetAce.ADVAPI32(?,00000000,?), ref: 005C0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005C0E96
GetLengthSid.ADVAPI32(?), ref: 005C0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 005C0EB5
HeapAlloc.KERNEL32(00000000), ref: 005C0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 005C0EDD
CopySid.ADVAPI32(00000000), ref: 005C0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005C0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005C0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 005C0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C0F6E
HeapFree.KERNEL32(00000000), ref: 005C0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C0F7E
HeapFree.KERNEL32(00000000), ref: 005C0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C0F8E
HeapFree.KERNEL32(00000000), ref: 005C0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 005C0FA1
HeapFree.KERNEL32(00000000), ref: 005C0FA8

Part of subcall function 005C1193: GetProcessHeap.KERNEL32(00000008,005C0BB1,?,00000000,?,005C0BB1,?), ref: 005C11A1
Part of subcall function 005C1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,005C0BB1,?), ref: 005C11A8
Part of subcall function 005C1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,005C0BB1,?), ref: 005C11B7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 10de0fbdf671270b801888ab7d7771b27cfa3909d949678ac4b54f1cbf8ecf5a
Instruction ID: 1533c10efadc8a3aeaf3b085d57315b066f8c2574a8ac9e6acafff087b28defa
Opcode Fuzzy Hash: 10de0fbdf671270b801888ab7d7771b27cfa3909d949678ac4b54f1cbf8ecf5a
Instruction Fuzzy Hash: F571597290021AEFDF209FA4DD48FAEBFB8BF15300F044529F919E6191DB359A59CB60

Function 005EC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,005FCC08,00000000,?,00000000,?,?), ref: 005EC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 005EC5A4
_wcslen.LIBCMT ref: 005EC5F4
_wcslen.LIBCMT ref: 005EC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 005EC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 005EC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 005EC84D
RegCloseKey.ADVAPI32(?), ref: 005EC881
RegCloseKey.ADVAPI32(00000000), ref: 005EC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 005EC960

Strings

REG_EXPAND_SZ, xrefs: 005EC5CD
REG_DWORD, xrefs: 005EC804
REG_QWORD, xrefs: 005EC8C3
REG_BINARY, xrefs: 005EC913
REG_SZ, xrefs: 005EC644
REG_MULTI_SZ, xrefs: 005EC6F5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: c0c39bbc6d382ce58fb74da0a2a38f229cb60d32b14f69e7c2bc5e22d59dda8b
Instruction ID: 53b9213ce0ebb9912efe7e88b9b9f4c6d37f657a1cf3123d4c5d1501e81736ad
Opcode Fuzzy Hash: c0c39bbc6d382ce58fb74da0a2a38f229cb60d32b14f69e7c2bc5e22d59dda8b
Instruction Fuzzy Hash: A4125D356042419FD718DF15C885A2ABFE5FF88714F14889DF89A9B3A2DB31ED42CB81

Function 005F091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005F09C6
_wcslen.LIBCMT ref: 005F0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005F0A54
_wcslen.LIBCMT ref: 005F0A8A
_wcslen.LIBCMT ref: 005F0B06
_wcslen.LIBCMT ref: 005F0B81

Part of subcall function 0057F9F2: _wcslen.LIBCMT ref: 0057F9FD

Part of subcall function 005C2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005C2BFA

Strings

GETTOTALCOUNT, xrefs: 005F09F2, 005F0A17
GETSELECTED, xrefs: 005F0C4E
UNCHECK, xrefs: 005F0D3E
EXPAND, xrefs: 005F0BF8
EXISTS, xrefs: 005F0B7C, 005F0B97
CHECK, xrefs: 005F0A85, 005F0AA0
SELECT, xrefs: 005F0D11
COLLAPSE, xrefs: 005F0B01, 005F0B1C
ISCHECKED, xrefs: 005F0CE1
GETTEXT, xrefs: 005F0C97
GETITEMCOUNT, xrefs: 005F0C1E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 99fbb0c1736c73d84af802fc99a106c670fe7ad35a02678b9fb109cf4adbdfad
Instruction ID: 86da4b2ee3a4cd0b8bdb6020eebfb571253b0fe1d22600434707366f49633546
Opcode Fuzzy Hash: 99fbb0c1736c73d84af802fc99a106c670fe7ad35a02678b9fb109cf4adbdfad
Instruction Fuzzy Hash: 91E189352087169FC714DF24C45093ABBE2BF98318F18895DF99A9B3A2DB34ED45CB81

Function 005EC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EB6AE,?,?), ref: 005EC9B5
_wcslen.LIBCMT ref: 005EC9F1
_wcslen.LIBCMT ref: 005ECA68
_wcslen.LIBCMT ref: 005ECA9E
_wcslen.LIBCMT ref: 005ECAF9
_wcslen.LIBCMT ref: 005ECB2F
_wcslen.LIBCMT ref: 005ECB7F

Strings

HKLM, xrefs: 005ECA98, 005ECA9D
HKCR, xrefs: 005ECB29, 005ECB2E
HKCU, xrefs: 005ECBCE
HKEY_CURRENT_CONFIG, xrefs: 005ECB79, 005ECB7E
HKEY_LOCAL_MACHINE, xrefs: 005ECA62, 005ECA67
HKEY_CLASSES_ROOT, xrefs: 005ECAF3, 005ECAF8
HKCC, xrefs: 005ECBAC
HKEY_CURRENT_USER, xrefs: 005ECBBD
HKU, xrefs: 005ECBF0
HKEY_USERS, xrefs: 005ECBDF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 0b574317732dce67eb7798c0be072377c2bde064dcb0f8d8457114684489f98a
Instruction ID: 63bbcf845fdd2bda24ebac2b1380ec6d77a9477eb0407038006283efd66dc887
Opcode Fuzzy Hash: 0b574317732dce67eb7798c0be072377c2bde064dcb0f8d8457114684489f98a
Instruction Fuzzy Hash: E0711B326005AB4BCB28DE7ED9415BE3F95BFA0750B650524FCEAA7284E630CD42C790

Function 005F833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005F835A
_wcslen.LIBCMT ref: 005F836E
_wcslen.LIBCMT ref: 005F8391
_wcslen.LIBCMT ref: 005F83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 005F83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,005F361A,?), ref: 005F844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005F8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 005F84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005F8501
FreeLibrary.KERNEL32(?), ref: 005F850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 005F851D
DestroyIcon.USER32(?), ref: 005F852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 005F8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 005F8555

Strings

.icl, xrefs: 005F8368
.exe, xrefs: 005F8388
.dll, xrefs: 005F83AB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 24679b088b27fea0bd076721f340fc497316663bd7d0b5c912b5bdfa9e7a0382
Instruction ID: 2ce190765e61936b11c69bd383eb56f15f0d8abc5779967bf8a753051d44f3fd
Opcode Fuzzy Hash: 24679b088b27fea0bd076721f340fc497316663bd7d0b5c912b5bdfa9e7a0382
Instruction Fuzzy Hash: BE61F17150021ABBEB14DF64CC49BBE7FA8BB44710F10451AFD15EA1D0EB78A984DBA0

Function 00567778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include-once, xrefs: 0056782F
#requireadmin, xrefs: 005677FF
', xrefs: 005A5169
#include, xrefs: 00567847
Cannot parse #include, xrefs: 005A5279
#comments-end, xrefs: 005678D9
#notrayicon, xrefs: 005677E7
", xrefs: 005A5153
#comments-start, xrefs: 0056785F, 005678B1
#OnAutoItStartRegister, xrefs: 00567817
#pragma compile, xrefs: 005677D3
Bad directive syntax error, xrefs: 005A519A
Unterminated group of comments, xrefs: 005A528C
#cs, xrefs: 00567873, 005678C5
#ce, xrefs: 005678ED

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 799550ba1b7e39066175c390a4f12b4583cff56bd2623c9529a64b522a195754
Instruction ID: d94ef84bd99b9036cf3c1fa046dc8711e0fe3e4520ba757b6452fd34db812345
Opcode Fuzzy Hash: 799550ba1b7e39066175c390a4f12b4583cff56bd2623c9529a64b522a195754
Instruction Fuzzy Hash: 2D81C27160460AABDB20AF60DC46FBE3FA9FF99304F144424FD05AB196EB74D901CBA1

Function 005D3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 005D3EF8
_wcslen.LIBCMT ref: 005D3F03
_wcslen.LIBCMT ref: 005D3F5A
_wcslen.LIBCMT ref: 005D3F98
GetDriveTypeW.KERNEL32(?), ref: 005D3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005D401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005D4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005D4087

Strings

close cd wait, xrefs: 005D4072
close, xrefs: 005D3EFE, 005D3F18
closed, xrefs: 005D3F08, 005D3F2D, 005D3F46, 005D3F7E, 005D3F97
type cdaudio alias cd wait, xrefs: 005D4001
set cd door , xrefs: 005D4028
open, xrefs: 005D3F54, 005D3F59
wait, xrefs: 005D4044
open , xrefs: 005D3FE5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 670e582f8fadff05bed7964b70f6fc3dde6e5c487a49c631e47c8194671f413d
Instruction ID: 8ab24be85a3dbe2f534869a9a8aefe7418866da1da888061203749ae0bbacfdd
Opcode Fuzzy Hash: 670e582f8fadff05bed7964b70f6fc3dde6e5c487a49c631e47c8194671f413d
Instruction Fuzzy Hash: E771BF726042169FC320EF28C88586ABBE5FF94758F10492EF89597361EB34ED45CB92

Function 005C5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 005C5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 005C5A40
SetWindowTextW.USER32(?,?), ref: 005C5A57
GetDlgItem.USER32(?,000003EA), ref: 005C5A6C
SetWindowTextW.USER32(00000000,?), ref: 005C5A72
GetDlgItem.USER32(?,000003E9), ref: 005C5A82
SetWindowTextW.USER32(00000000,?), ref: 005C5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 005C5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 005C5AC3
GetWindowRect.USER32(?,?), ref: 005C5ACC
_wcslen.LIBCMT ref: 005C5B33
SetWindowTextW.USER32(?,?), ref: 005C5B6F
GetDesktopWindow.USER32 ref: 005C5B75
GetWindowRect.USER32(00000000), ref: 005C5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 005C5BD3
GetClientRect.USER32(?,?), ref: 005C5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 005C5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 005C5C2F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 6067e51a46e96df4f1ad3b6b18cf01c9e4a56dab80c2ff92e33091bfbdbd661a
Instruction ID: 9819de5c2c93577cfbffd07c00b7046aa3cea4550b348010b5600858e59bb1ad
Opcode Fuzzy Hash: 6067e51a46e96df4f1ad3b6b18cf01c9e4a56dab80c2ff92e33091bfbdbd661a
Instruction Fuzzy Hash: FA713831900A09AFDB209FA9CE85FAEBFF5FB48705F10492CE542A65A0E775B944CB50

Function 005DFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 005DFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 005DFE32
LoadCursorW.USER32(00000000,00007F00), ref: 005DFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 005DFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 005DFE53
LoadCursorW.USER32(00000000,00007F01), ref: 005DFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 005DFE69
LoadCursorW.USER32(00000000,00007F88), ref: 005DFE74
LoadCursorW.USER32(00000000,00007F80), ref: 005DFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 005DFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 005DFE95
LoadCursorW.USER32(00000000,00007F85), ref: 005DFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 005DFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 005DFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 005DFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 005DFECC
GetCursorInfo.USER32(?), ref: 005DFEDC
GetLastError.KERNEL32 ref: 005DFF1E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: e98d4bf50d49250ad1ddaed0edbc68f07494787ffd2499722c3e5482f3dbd92f
Instruction ID: 8c4699e57183c1f4c33a5aa9fe397892f7d226267322f3ff8f0358790921d606
Opcode Fuzzy Hash: e98d4bf50d49250ad1ddaed0edbc68f07494787ffd2499722c3e5482f3dbd92f
Instruction Fuzzy Hash: 55414570D4531A6ADB209FBA8C8986EBFE8FF04754B50452AE11DE7281DB789901CF91

Function 005C30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005C318D
_wcslen.LIBCMT ref: 005C31F8

Strings

NAME, xrefs: 005C3335, 005C3346
CLASS, xrefs: 005C3188, 005C31A5
TEXT, xrefs: 005C347C
[b, xrefs: 005C339A
CLASSNN, xrefs: 005C31F3, 005C3204
INSTANCE, xrefs: 005C3453
REGEXPCLASS, xrefs: 005C3255, 005C3266

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[b
API String ID: 176396367-1132615434
Opcode ID: b6eefe826effd35399cf9b9fd0881ca423a2c94c6e5ca83a0a6f29ad3175a1b5
Instruction ID: 411b0b2bff58fb359431b1e3533aba3891c3ff43c5a9d0bf0a10a10b84920a89
Opcode Fuzzy Hash: b6eefe826effd35399cf9b9fd0881ca423a2c94c6e5ca83a0a6f29ad3175a1b5
Instruction Fuzzy Hash: 48E1D231A0052AAECF289FE8C495BEDBFA1BF44710F54C51DE856B7240DB30AE85CB90

Function 005800C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 005800C6

Part of subcall function 005800ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0063070C,00000FA0,B3633D3F,?,?,?,?,005A23B3,000000FF), ref: 0058011C
Part of subcall function 005800ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,005A23B3,000000FF), ref: 00580127
Part of subcall function 005800ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,005A23B3,000000FF), ref: 00580138
Part of subcall function 005800ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0058014E
Part of subcall function 005800ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0058015C
Part of subcall function 005800ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0058016A
Part of subcall function 005800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00580195
Part of subcall function 005800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 005801A0

___scrt_fastfail.LIBCMT ref: 005800E7

Part of subcall function 005800A3: __onexit.LIBCMT ref: 005800A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00580122
InitializeConditionVariable, xrefs: 00580148
WakeAllConditionVariable, xrefs: 00580162
SleepConditionVariableCS, xrefs: 00580154
kernel32.dll, xrefs: 00580133

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: f9c75c112764d5f2ffbaaba85f5bc6b51686530e57f3ac54443ec02c25df552a
Instruction ID: a7b19b8af0a9ecce10ca8eec0f6995ccf0430a093abb039fd10bf7191380fa0a
Opcode Fuzzy Hash: f9c75c112764d5f2ffbaaba85f5bc6b51686530e57f3ac54443ec02c25df552a
Instruction Fuzzy Hash: 6A210432644715ABE7606B64AC0EB3E3FA9FF45B60F000539FD01F66D1DB689808CB90

Function 005D44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,005FCC08), ref: 005D4527
_wcslen.LIBCMT ref: 005D453B
_wcslen.LIBCMT ref: 005D4599
_wcslen.LIBCMT ref: 005D45F4
_wcslen.LIBCMT ref: 005D463F
_wcslen.LIBCMT ref: 005D46A7

Part of subcall function 0057F9F2: _wcslen.LIBCMT ref: 0057F9FD

GetDriveTypeW.KERNEL32(?,00626BF0,00000061), ref: 005D4743

Strings

unknown, xrefs: 005D4708
cdrom, xrefs: 005D458F, 005D4594
all, xrefs: 005D4531, 005D4536
network, xrefs: 005D469D, 005D46A2
ramdisk, xrefs: 005D46F1
removable, xrefs: 005D45EA, 005D45EF
fixed, xrefs: 005D4635, 005D463A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 87101231a921b073a00e3e2d06642ee4cac563f064c1f5a0b3b70114c4aedee7
Instruction ID: b2b968ab4b208e604d490a6c1f394c55be3b697414b1a9534c64b99d9a2c1b00
Opcode Fuzzy Hash: 87101231a921b073a00e3e2d06642ee4cac563f064c1f5a0b3b70114c4aedee7
Instruction Fuzzy Hash: 67B1AB316083029BC720DF28D894A6ABBE5BFA5764F50492FF49AD7391D730D845CFA2

Function 005F911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

DragQueryPoint.SHELL32(?,?), ref: 005F9147

Part of subcall function 005F7674: ClientToScreen.USER32(?,?), ref: 005F769A
Part of subcall function 005F7674: GetWindowRect.USER32(?,?), ref: 005F7710
Part of subcall function 005F7674: PtInRect.USER32(?,?,005F8B89), ref: 005F7720

SendMessageW.USER32(?,000000B0,?,?), ref: 005F91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 005F91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 005F91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 005F9225
SendMessageW.USER32(?,000000B0,?,?), ref: 005F923E
SendMessageW.USER32(?,000000B1,?,?), ref: 005F9255
SendMessageW.USER32(?,000000B1,?,?), ref: 005F9277
DragFinish.SHELL32(?), ref: 005F927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 005F9371

Strings

`g, xrefs: 005F92BB
@GUI_DROPID, xrefs: 005F929E
@GUI_DRAGID, xrefs: 005F92E9
@GUI_DRAGFILE, xrefs: 005F9320

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$`g
API String ID: 221274066-2092015487
Opcode ID: 5f1ed25525b76547392ef3d2f1d8939a78de590ed92d7059e6edd3f9c53c4e16
Instruction ID: 41bec2d25d3cfeb8db3739daf7d032a7bae947d249911d01f00754aaec8e6238
Opcode Fuzzy Hash: 5f1ed25525b76547392ef3d2f1d8939a78de590ed92d7059e6edd3f9c53c4e16
Instruction Fuzzy Hash: 52616671108306AFD701DF64D989EABBFE9FBD9350F00092EF595971A0DB309A49CB92

Function 0056326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00631990), ref: 005A2F8D
GetMenuItemCount.USER32(00631990), ref: 005A303D
GetCursorPos.USER32(?), ref: 005A3081
SetForegroundWindow.USER32(00000000), ref: 005A308A
TrackPopupMenuEx.USER32(00631990,00000000,?,00000000,00000000,00000000), ref: 005A309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005A30A9

Strings

0, xrefs: 0056327D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 6b6396a5c8791728009ab8fa960a6a5a9552db832eab4658c6b7cdaf9d93d198
Instruction ID: e2a4f5ba0a85fa695038b205933ec2c6eb3076f157202d1f2c8b286aca2a04bd
Opcode Fuzzy Hash: 6b6396a5c8791728009ab8fa960a6a5a9552db832eab4658c6b7cdaf9d93d198
Instruction Fuzzy Hash: 96710B70644206BEFB218F68CC4AFAEBF65FF06324F204216F515AA1E0C7B1AD54DB50

Function 005F6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 005F6DEB

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 005F6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 005F6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F6E94
DestroyWindow.USER32(?), ref: 005F6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00560000,00000000), ref: 005F6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F6EFD
GetDesktopWindow.USER32 ref: 005F6F16
GetWindowRect.USER32(00000000), ref: 005F6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 005F6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 005F6F4D

Part of subcall function 00579944: GetWindowLongW.USER32(?,000000EB), ref: 00579952

Strings

tooltips_class32, xrefs: 005F6E58, 005F6EDD
0, xrefs: 005F6D98

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: fc2208535f73178e684da421deb4a9f303f44afd263f2a50ab1ae98cb893b863
Instruction ID: a861226e6dc68896bb3bc5dc021006648563e5062274ea8f8b61f97c5a30a34a
Opcode Fuzzy Hash: fc2208535f73178e684da421deb4a9f303f44afd263f2a50ab1ae98cb893b863
Instruction Fuzzy Hash: 25714A75104249AFDB21DF18D884BBABFE9FB89304F04481DFA99CB2A1C774A909DB11

Function 005DC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005DC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 005DC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 005DC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 005DC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 005DC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 005DC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005DC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005DC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 005DC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 005DC5F0
InternetCloseHandle.WININET(00000000), ref: 005DC5FB

Strings

, xrefs: 005DC575

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 8e788fa8b4951c6903eca71151f08669e2c7dac2608acc2c9755985ce621f3d4
Instruction ID: 99d4e224461f55ddb2479df8e241eefc4d2074cc72dc3391a44d3ad0ba38140a
Opcode Fuzzy Hash: 8e788fa8b4951c6903eca71151f08669e2c7dac2608acc2c9755985ce621f3d4
Instruction Fuzzy Hash: 0A513AB150020AAFDB319F68D948ABA7FBCFB58754F00452BF946D6250DB34E948EB60

Function 005F856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 005F8592
GetFileSize.KERNEL32(00000000,00000000), ref: 005F85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 005F85AD
CloseHandle.KERNEL32(00000000), ref: 005F85BA
GlobalLock.KERNEL32(00000000), ref: 005F85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 005F85D7
GlobalUnlock.KERNEL32(00000000), ref: 005F85E0
CloseHandle.KERNEL32(00000000), ref: 005F85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 005F85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,005FFC38,?), ref: 005F8611
GlobalFree.KERNEL32(00000000), ref: 005F8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 005F8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 005F8671
DeleteObject.GDI32(00000000), ref: 005F8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 005F86AF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 09506bcd6c5846918c6d99a7312d9f6fe14600c440ebc1d0a2a90d513e839f7e
Instruction ID: 40980210bee10a439930d647e12ccc1a8550930b230e431f66fe02feac9ca86b
Opcode Fuzzy Hash: 09506bcd6c5846918c6d99a7312d9f6fe14600c440ebc1d0a2a90d513e839f7e
Instruction Fuzzy Hash: 2D410875600208AFDB11DFA5CD48EBA7FB8FF99751F104068F905EB260DB389905EB60

Function 005D14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 005D1502
VariantCopy.OLEAUT32(?,?), ref: 005D150B
VariantClear.OLEAUT32(?), ref: 005D1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 005D15FB
VarR8FromDec.OLEAUT32(?,?), ref: 005D1657
VariantInit.OLEAUT32(?), ref: 005D1708
SysFreeString.OLEAUT32(?), ref: 005D178C
VariantClear.OLEAUT32(?), ref: 005D17D8
VariantClear.OLEAUT32(?), ref: 005D17E7
VariantInit.OLEAUT32(00000000), ref: 005D1823

Strings

Default, xrefs: 005D16AF
%4d%02d%02d%02d%02d%02d, xrefs: 005D1625

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 03dba8d03480823ce2ed27924d1fcbe89e2e8414ff3cc96b3025424557fa07f5
Instruction ID: 088183b37cbe54fb03b3cfc7cf8d99fbee5d2c277f7b8570ee58778285c7e1c8
Opcode Fuzzy Hash: 03dba8d03480823ce2ed27924d1fcbe89e2e8414ff3cc96b3025424557fa07f5
Instruction Fuzzy Hash: ECD1DF71A00916EBDB209F69F889B79BFB5BF85700F108457E406AB290DB38DC44EF65

Function 005EB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005EC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EB6AE,?,?), ref: 005EC9B5
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005EC9F1
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA68
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005EB772
RegDeleteValueW.ADVAPI32(?,?), ref: 005EB80A
RegCloseKey.ADVAPI32(?), ref: 005EB87E
RegCloseKey.ADVAPI32(?), ref: 005EB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 005EB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 005EB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 005EB922
FreeLibrary.KERNEL32(00000000), ref: 005EB983
RegCloseKey.ADVAPI32(00000000), ref: 005EB994

Strings

advapi32.dll, xrefs: 005EB8ED
RegDeleteKeyExW, xrefs: 005EB8FE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: d0298b5db654c9d542a231961d935114330dabca28bcb6bf20633dec3902f8a9
Instruction ID: 660d1489f7e995b9f8ecd7e8946efb23adaa7a8db05ceded46c2e0a39f391cb0
Opcode Fuzzy Hash: d0298b5db654c9d542a231961d935114330dabca28bcb6bf20633dec3902f8a9
Instruction Fuzzy Hash: 08C16C30208242AFE714DF15C499F2ABFE5BF84308F14859CE49A8B7A2CB75ED45CB91

Function 005E255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005E25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 005E25E8
CreateCompatibleDC.GDI32(?), ref: 005E25F4
SelectObject.GDI32(00000000,?), ref: 005E2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 005E266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 005E26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 005E26D0
SelectObject.GDI32(?,?), ref: 005E26D8
DeleteObject.GDI32(?), ref: 005E26E1
DeleteDC.GDI32(?), ref: 005E26E8
ReleaseDC.USER32(00000000,?), ref: 005E26F3

Strings

(, xrefs: 005E268D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: c56301afd6509e6adcb2db6cc72434a2950a4d88c95fec136bafb7c9a15f3986
Instruction ID: 4f9a146299478b01d4cfd0957155bd76a8f2914ac7325ee7899ac0883397e3b5
Opcode Fuzzy Hash: c56301afd6509e6adcb2db6cc72434a2950a4d88c95fec136bafb7c9a15f3986
Instruction Fuzzy Hash: 5661E175D00219EFCF04CFA8D988EAEBBB9FF48310F20852AE956A7250D774A951DF50

Function 0059DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0059DAA1

Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D659
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D66B
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D67D
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D68F
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D6A1
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D6B3
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D6C5
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D6D7
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D6E9
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D6FB
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D70D
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D71F
Part of subcall function 0059D63C: _free.LIBCMT ref: 0059D731

_free.LIBCMT ref: 0059DA96

Part of subcall function 005929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000), ref: 005929DE
Part of subcall function 005929C8: GetLastError.KERNEL32(00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000,00000000), ref: 005929F0

_free.LIBCMT ref: 0059DAB8
_free.LIBCMT ref: 0059DACD
_free.LIBCMT ref: 0059DAD8
_free.LIBCMT ref: 0059DAFA
_free.LIBCMT ref: 0059DB0D
_free.LIBCMT ref: 0059DB1B
_free.LIBCMT ref: 0059DB26
_free.LIBCMT ref: 0059DB5E
_free.LIBCMT ref: 0059DB65
_free.LIBCMT ref: 0059DB82
_free.LIBCMT ref: 0059DB9A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0f3c7e71f15c6f0efd2703291feff8d6319b9069c7346574e018f960ce1ce690
Instruction ID: 07631fe732496987650aa4636d3b442d4ffaa115b0e10daa6c15ca7d872dec74
Opcode Fuzzy Hash: 0f3c7e71f15c6f0efd2703291feff8d6319b9069c7346574e018f960ce1ce690
Instruction Fuzzy Hash: 25312831604606AFEF21AA39E849B5ABFFAFF50320F554429E44DD7191DA35AC908B70

Function 005C365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 005C369C
_wcslen.LIBCMT ref: 005C36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 005C3797
GetClassNameW.USER32(?,?,00000400), ref: 005C380C
GetDlgCtrlID.USER32(?), ref: 005C385D
GetWindowRect.USER32(?,?), ref: 005C3882
GetParent.USER32(?), ref: 005C38A0
ScreenToClient.USER32(00000000), ref: 005C38A7
GetClassNameW.USER32(?,?,00000100), ref: 005C3921
GetWindowTextW.USER32(?,?,00000400), ref: 005C395D

Strings

%s%u, xrefs: 005C3734

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 47c64d9f76d768a692fc5dee4558cea00770fe777f8c740fabb811f762445732
Instruction ID: c5fbf00067848598b9ac1662300482fc1239c7c82f5b83184bcb746e8e016608
Opcode Fuzzy Hash: 47c64d9f76d768a692fc5dee4558cea00770fe777f8c740fabb811f762445732
Instruction Fuzzy Hash: C591B37120460BAFD719DFA4C885FAAFBA8FF44350F00852DF999D2190DB74EA49CB91

Function 005C4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 005C4994
GetWindowTextW.USER32(?,?,00000400), ref: 005C49DA
_wcslen.LIBCMT ref: 005C49EB
CharUpperBuffW.USER32(?,00000000), ref: 005C49F7
_wcsstr.LIBVCRUNTIME ref: 005C4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 005C4A64
GetWindowTextW.USER32(?,?,00000400), ref: 005C4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 005C4AE6
GetClassNameW.USER32(?,?,00000400), ref: 005C4B20
GetWindowRect.USER32(?,?), ref: 005C4B8B

Strings

ThumbnailClass, xrefs: 005C4A6F, 005C4AF1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 45343a05653cd01431edf8a2e8082485e10f30a567324bea021cf0aa48b06659
Instruction ID: 64a58558381441af3689758bb30500cfdd596e54272d8358eaaa2011f7a265a3
Opcode Fuzzy Hash: 45343a05653cd01431edf8a2e8082485e10f30a567324bea021cf0aa48b06659
Instruction Fuzzy Hash: 3C918C7100820A9FDB04DE94C995FAA7FA9FF84314F04846DFD869A096DB34ED49CFA1

Function 005CBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00631990,000000FF,00000000,00000030), ref: 005CBFAC
SetMenuItemInfoW.USER32(00631990,00000004,00000000,00000030), ref: 005CBFE1
Sleep.KERNEL32(000001F4), ref: 005CBFF3
GetMenuItemCount.USER32(?), ref: 005CC039
GetMenuItemID.USER32(?,00000000), ref: 005CC056
GetMenuItemID.USER32(?,-00000001), ref: 005CC082
GetMenuItemID.USER32(?,?), ref: 005CC0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005CC10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005CC124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005CC145

Strings

0, xrefs: 005CBF3D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 2cb2143e184f226ea5fdfbba0c9e869e5ed5bc5f40f5d64694b5767d44c9e39f
Instruction ID: 9394831c3f83179dcbe8042d68c23944ef9f0e6d0156bbe43cc3559f6d143a99
Opcode Fuzzy Hash: 2cb2143e184f226ea5fdfbba0c9e869e5ed5bc5f40f5d64694b5767d44c9e39f
Instruction Fuzzy Hash: BA617BB090024AAFEF11CFA4CD88FBE7FA8FB45344F040459E815A7291D735AD05DBA0

Function 005ECC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 005ECC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 005ECC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 005ECD48

Part of subcall function 005ECC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 005ECCAA
Part of subcall function 005ECC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 005ECCBD
Part of subcall function 005ECC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 005ECCCF
Part of subcall function 005ECC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 005ECD05
Part of subcall function 005ECC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 005ECD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 005ECCF3

Strings

advapi32.dll, xrefs: 005ECCB8
RegDeleteKeyExW, xrefs: 005ECCC9

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: cc1770b2f875b43e5390d285edb4081e3e94e718950f6f64c22c8b08a2783423
Instruction ID: ab88a4e8c6dbb0a7c3c0a6b7ef8e94e910e1b180fbffe6ccac178482898494e6
Opcode Fuzzy Hash: cc1770b2f875b43e5390d285edb4081e3e94e718950f6f64c22c8b08a2783423
Instruction Fuzzy Hash: 92318971901169BBDB248B56DD88EFFBF7CFF15740F000075E946E6200DA388E4AEAA0

Function 005D3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005D3D40
_wcslen.LIBCMT ref: 005D3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 005D3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 005D3DBE
RemoveDirectoryW.KERNEL32(?), ref: 005D3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 005D3E55
CloseHandle.KERNEL32(00000000), ref: 005D3E60
CloseHandle.KERNEL32(00000000), ref: 005D3E6B

Strings

\??\%s, xrefs: 005D3D5B
:, xrefs: 005D3D82
\, xrefs: 005D3D77

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 36cb7078ee482da27bbeadfae3a8b991188235200e7bd29964b16e1d3302f954
Instruction ID: 5cd652e98e74454ab92121499bd2b699174f40d0f3081031eb9e2144fff30e21
Opcode Fuzzy Hash: 36cb7078ee482da27bbeadfae3a8b991188235200e7bd29964b16e1d3302f954
Instruction Fuzzy Hash: FE31937590020AAADB20ABA4DC49FEF3BBDFF88740F1040B6F509D6160E7749744DB25

Function 005CE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 005CE6B4

Part of subcall function 0057E551: timeGetTime.WINMM(?,?,005CE6D4), ref: 0057E555

Sleep.KERNEL32(0000000A), ref: 005CE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 005CE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 005CE727
SetActiveWindow.USER32 ref: 005CE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 005CE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 005CE773
Sleep.KERNEL32(000000FA), ref: 005CE77E
IsWindow.USER32 ref: 005CE78A
EndDialog.USER32(00000000), ref: 005CE79B

Strings

BUTTON, xrefs: 005CE719

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 93ddc7b4c34d55cc47f7ed100dec321364a4c2a8a27c5df3dfefd26a76264402
Instruction ID: f91718898f40c171a8c6a0cf9f7f40b9b48687c52e9ea03cdde13cf7dc0553db
Opcode Fuzzy Hash: 93ddc7b4c34d55cc47f7ed100dec321364a4c2a8a27c5df3dfefd26a76264402
Instruction Fuzzy Hash: D021A1B120064AAFEB005FA1ED9BF353FAAFB66348B102438F401C51A1DB75AC54EA64

Function 005CE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 005CEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 005CEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005CEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 005CEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 005CEAA7

Strings

play PlayMe wait, xrefs: 005CEA91
alias PlayMe, xrefs: 005CEA36
close PlayMe, xrefs: 005CEA6E, 005CEA9B
status PlayMe mode, xrefs: 005CEA58
play PlayMe, xrefs: 005CEAA2
open , xrefs: 005CEA0C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: db150dd302d0525158ed95b9582a34273fb6070919841fcd4d64103f84b1a68b
Instruction ID: ffd4bc5eb2726b356a308d5177a2478d6a9bdc1cd1d804b40177f7420ce35427
Opcode Fuzzy Hash: db150dd302d0525158ed95b9582a34273fb6070919841fcd4d64103f84b1a68b
Instruction Fuzzy Hash: F311EF31A9026A7DD720A7A5ED4EEFB6E7DFBD2B40F4104297811A20D1EEB05945CAB0

Function 005C5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 005C5CE2
GetWindowRect.USER32(00000000,?), ref: 005C5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 005C5D59
GetDlgItem.USER32(?,00000002), ref: 005C5D69
GetWindowRect.USER32(00000000,?), ref: 005C5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 005C5DCF
GetDlgItem.USER32(?,000003E9), ref: 005C5DDD
GetWindowRect.USER32(00000000,?), ref: 005C5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 005C5E31
GetDlgItem.USER32(?,000003EA), ref: 005C5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 005C5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 005C5E67

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: b2e4edfe2f7284970490545619bbab3e463b4366059e32f6fac1f146fc77d72a
Instruction ID: a48ad17d8c8b62d33587ab3c4a83e92e698efac261e854565044016cef2542bf
Opcode Fuzzy Hash: b2e4edfe2f7284970490545619bbab3e463b4366059e32f6fac1f146fc77d72a
Instruction Fuzzy Hash: A951FE71A00609AFDF18DFA8DD89AAE7BB9FB58300F148129F516E7290D774AE44CB50

Function 00578BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00578F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00578BE8,?,00000000,?,?,?,?,00578BBA,00000000,?), ref: 00578FC5

DestroyWindow.USER32(?), ref: 00578C81
KillTimer.USER32(00000000,?,?,?,?,00578BBA,00000000,?), ref: 00578D1B
DestroyAcceleratorTable.USER32(00000000), ref: 005B6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00578BBA,00000000,?), ref: 005B69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00578BBA,00000000,?), ref: 005B69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00578BBA,00000000), ref: 005B69D4
DeleteObject.GDI32(00000000), ref: 005B69E6

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 3cfc3835c0463a453f80c22ff55bfd50d152c9a72acdf9a226b82b19cdf0406d
Instruction ID: 11d0293346244af18d1441dfeec272c25f10b5cf1fcfd1432ed20f2f222d948d
Opcode Fuzzy Hash: 3cfc3835c0463a453f80c22ff55bfd50d152c9a72acdf9a226b82b19cdf0406d
Instruction Fuzzy Hash: 0F618E30142605DFCB229F15EA4CB757FF6FB51312F149929E0469A5A0CB39BC85EF90

Function 00579838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00579944: GetWindowLongW.USER32(?,000000EB), ref: 00579952

GetSysColor.USER32(0000000F), ref: 00579862

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 1b377468b540dd56a5c6bc52623ef7f689d0b0072cd48ea610f746fb77516a3a
Instruction ID: 4dd347117d366c1a8cf6cf32b004cf48c4cbf1330f85e3a8773b3016e5840666
Opcode Fuzzy Hash: 1b377468b540dd56a5c6bc52623ef7f689d0b0072cd48ea610f746fb77516a3a
Instruction Fuzzy Hash: 7B41E4311046089FDB209F38AC88BB93F65FB57330F148655F9A68B2E1C7349C42EB61

Function 00598D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.X, xrefs: 0059903A, 00598FD0, 00598FF2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: .X
API String ID: 0-3424028424
Opcode ID: e56c67a1fc268f65d071d3f7f8614ee006e32597ef6d7950720cb13014a9ede6
Instruction ID: e2b5bd2e92181e02627f278b66505ebe0c2b042f6c94020243623e92e12ebd6b
Opcode Fuzzy Hash: e56c67a1fc268f65d071d3f7f8614ee006e32597ef6d7950720cb13014a9ede6
Instruction Fuzzy Hash: A8C1C07490424AAFDF11EFACC849BBDBFB5BF4A310F144099E825A7292D7349941CB61

Function 005D3388 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 005D33CF

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 005D33F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 005D3504
Line %d (File "%s"):, xrefs: 005D3443, 005D345C
^ ERROR , xrefs: 005D349E
G`g, xrefs: 005D3388
Incorrect parameters to object property !, xrefs: 005D34AB
Error: , xrefs: 005D34D1
"%s" (%d) : ==> %s:, xrefs: 005D3522

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$G`g$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3144458409
Opcode ID: 0b7677d0ba6eec19389646a05a632b0e131549ecee7c97afbd53cef53976f24a
Instruction ID: b55073f07dd2b67314b1cad30960074421a502a6fe0827f6349004a859c5071f
Opcode Fuzzy Hash: 0b7677d0ba6eec19389646a05a632b0e131549ecee7c97afbd53cef53976f24a
Instruction Fuzzy Hash: F8518E3190020AAADF14EBA0DE4AEEEBB79BF54340F204466F505731A1EB352F58DF61

Function 005C96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,005AF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 005C9717
LoadStringW.USER32(00000000,?,005AF7F8,00000001), ref: 005C9720

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,005AF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 005C9742
LoadStringW.USER32(00000000,?,005AF7F8,00000001), ref: 005C9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 005C9866

Strings

Line %d:, xrefs: 005C97A0
%s (%d) : ==> %s: %s %s, xrefs: 005C984A
Line %d (File "%s"):, xrefs: 005C978F
^ ERROR, xrefs: 005C97FB
Error: , xrefs: 005C981D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 305d181b8666a7b97e62e40e389c1cef16f032ecfa25bc75080f37227997f299
Instruction ID: 4e7f188b89a135d50f41f32d4468aa83995f33aff3a05f2e886c757546115411
Opcode Fuzzy Hash: 305d181b8666a7b97e62e40e389c1cef16f032ecfa25bc75080f37227997f299
Instruction Fuzzy Hash: FF414E7290021AAADB04FBE0DE4AEEE7B79BF95340F200425F50573092EB356F48CB61

Function 005C06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005C07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005C07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005C07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 005C0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 005C082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005C0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005C083C

Strings

\CLSID, xrefs: 005C0724
\IPC$, xrefs: 005C0784
SOFTWARE\Classes\, xrefs: 005C070E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: af883f2c30b2860edd37425e06719a731f14b5c8ccc744edd12402e7671bca71
Instruction ID: 0950854c618ff3eca77d87cae840e70bc89010dbfb0b26a9d481860a0f3af30d
Opcode Fuzzy Hash: af883f2c30b2860edd37425e06719a731f14b5c8ccc744edd12402e7671bca71
Instruction Fuzzy Hash: 78410772C10229AADB15EBA4DC89DEDBB78BF54350B144129E901A31A1EB309E44CFA0

Function 005E3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005E3C5C
CoInitialize.OLE32(00000000), ref: 005E3C8A
CoUninitialize.OLE32 ref: 005E3C94
_wcslen.LIBCMT ref: 005E3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 005E3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 005E3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 005E3F0E
CoGetObject.OLE32(?,00000000,005FFB98,?), ref: 005E3F2D
SetErrorMode.KERNEL32(00000000), ref: 005E3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 005E3FC4
VariantClear.OLEAUT32(?), ref: 005E3FD8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 2d6953a3060e2274ba03b72f4fc4f8797596c7ee4b7f11caefd0e3b921a57167
Instruction ID: 40d5555053ad427064d75bd6070159b52ce8b72f1482b37110b624136e3ffe4b
Opcode Fuzzy Hash: 2d6953a3060e2274ba03b72f4fc4f8797596c7ee4b7f11caefd0e3b921a57167
Instruction Fuzzy Hash: 65C143716082459FC704DF69C98892BBBE9FF89744F00496DF98A9B220D730EE05CB52

Function 005D7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005D7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 005D7B8F
SHGetDesktopFolder.SHELL32(?), ref: 005D7BA3
CoCreateInstance.OLE32(005FFD08,00000000,00000001,00626E6C,?), ref: 005D7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 005D7C74
CoTaskMemFree.OLE32(?,?), ref: 005D7CCC
SHBrowseForFolderW.SHELL32(?), ref: 005D7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 005D7D7A
CoTaskMemFree.OLE32(00000000), ref: 005D7D81
CoTaskMemFree.OLE32(00000000), ref: 005D7DD6
CoUninitialize.OLE32 ref: 005D7DDC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 7bec39ef69e1f837bb23257e7bd39468dcfe894d3d7198209b4178925037c655
Instruction ID: 829d11dcbcd7dfe9ef0dbd18c9872b862e0ea0154f5c69788b86b216bdcd0a50
Opcode Fuzzy Hash: 7bec39ef69e1f837bb23257e7bd39468dcfe894d3d7198209b4178925037c655
Instruction Fuzzy Hash: EFC1FB75A04109AFDB14DF68C888DAEBFB9FF48304B1484AAE816DB361D731ED45CB90

Function 005F541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 005F5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F5515
CharNextW.USER32(00000158), ref: 005F5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 005F5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 005F559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F55AC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: e5f41fa39d76c758fe976594473b1a934273a74ae8a05f2e0c50e8024c432cbb
Instruction ID: 083333298a394db9dd8e16df8b88a0624baf75c6dcb45f31f2869b880315c3e1
Opcode Fuzzy Hash: e5f41fa39d76c758fe976594473b1a934273a74ae8a05f2e0c50e8024c432cbb
Instruction Fuzzy Hash: 8A619F3090460DAFDF109F54CD889FE7F79FB09721F108555FB25AA290E7788A85DB60

Function 005BFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 005BFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 005BFB08
VariantInit.OLEAUT32(?), ref: 005BFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 005BFB3A
VariantCopy.OLEAUT32(?,?), ref: 005BFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 005BFBA1
VariantClear.OLEAUT32(?), ref: 005BFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 005BFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005BFBCC
VariantClear.OLEAUT32(?), ref: 005BFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005BFBE9

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: d9a6c4122d8d86cb230ee5a3d2d5299b10820704120ed766dd80bb809f6c7688
Instruction ID: 588fbbe173e6666c12a59dc31b9bb608d51228bb46358f515f354b3b777467e2
Opcode Fuzzy Hash: d9a6c4122d8d86cb230ee5a3d2d5299b10820704120ed766dd80bb809f6c7688
Instruction Fuzzy Hash: 7F415D35A00219AFCF04DF68CC589EEBFB9FF58345F008469E845E7261CB74A945DBA0

Function 005C9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 005C9CA1
GetAsyncKeyState.USER32(000000A0), ref: 005C9D22
GetKeyState.USER32(000000A0), ref: 005C9D3D
GetAsyncKeyState.USER32(000000A1), ref: 005C9D57
GetKeyState.USER32(000000A1), ref: 005C9D6C
GetAsyncKeyState.USER32(00000011), ref: 005C9D84
GetKeyState.USER32(00000011), ref: 005C9D96
GetAsyncKeyState.USER32(00000012), ref: 005C9DAE
GetKeyState.USER32(00000012), ref: 005C9DC0
GetAsyncKeyState.USER32(0000005B), ref: 005C9DD8
GetKeyState.USER32(0000005B), ref: 005C9DEA

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7850232be9e8f915f24b58a64f3a5b207ce2d46ce3c8217463ccc2a0964376a5
Instruction ID: 70530feeecd89896974ab7a7d971ffa78660ed28293b6847fb3f8ba0ca4e5bd8
Opcode Fuzzy Hash: 7850232be9e8f915f24b58a64f3a5b207ce2d46ce3c8217463ccc2a0964376a5
Instruction Fuzzy Hash: FC41D6745047C96DFF3086E4980CBB5BEA07B21344F08805EDAC7665C2DBA89EC8C7A2

Function 005E055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 005E05BC
inet_addr.WSOCK32(?), ref: 005E061C
gethostbyname.WSOCK32(?), ref: 005E0628
IcmpCreateFile.IPHLPAPI ref: 005E0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 005E06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 005E06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 005E07B9
WSACleanup.WSOCK32 ref: 005E07BF

Strings

Ping, xrefs: 005E0676

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 4fc43656549ff684f8ebf1c7d5dac92e24a3095fdf8a4468d32d367d880fe6a9
Instruction ID: 13e5501851599b7f6589ee565f70c7d3062242c7c9e739a76e7137360f9b1aa4
Opcode Fuzzy Hash: 4fc43656549ff684f8ebf1c7d5dac92e24a3095fdf8a4468d32d367d880fe6a9
Instruction Fuzzy Hash: 35919D356042419FD724DF16C588F1ABFE1FF84318F1499A9E4A98B6A2C7B0EC85CF91

Function 005E8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 005E8CF3

Part of subcall function 005C8E54: _wcslen.LIBCMT ref: 005C8E77

_wcslen.LIBCMT ref: 005E8D4E
_wcslen.LIBCMT ref: 005E8D9C
_wcslen.LIBCMT ref: 005E8DDC
_wcslen.LIBCMT ref: 005E8E6E

Strings

none, xrefs: 005E8E65, 005E8E6A
stdcall, xrefs: 005E8DD6, 005E8DDB
winapi, xrefs: 005E8D96, 005E8D9B
cdecl, xrefs: 005E8D48, 005E8D4D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 4d67338db42ba7eb5a40d7acf57fce0f9502a5c1b43641b4b73a42b36034e281
Instruction ID: dd49fd72a265bf135f95bb7e244e6a0edd08f077bd9c69f64934cd5a12c62712
Opcode Fuzzy Hash: 4d67338db42ba7eb5a40d7acf57fce0f9502a5c1b43641b4b73a42b36034e281
Instruction Fuzzy Hash: 6951B771A005579BCF18DF6DC9409BE7BAABF64310B204669E8AAE72C4DF31DD40C790

Function 005E372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 005E3774
CoUninitialize.OLE32 ref: 005E377F
CoCreateInstance.OLE32(?,00000000,00000017,005FFB78,?), ref: 005E37D9
IIDFromString.OLE32(?,?), ref: 005E384C
VariantInit.OLEAUT32(?), ref: 005E38E4
VariantClear.OLEAUT32(?), ref: 005E3936

Strings

NULL Pointer assignment, xrefs: 005E381E
Failed to create object, xrefs: 005E37E4, 005E389A
Invalid parameter, xrefs: 005E3865

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 66dd76841aa96a49e1a24495d51b9d5f8c0630564c23f4d9d68afb216b954481
Instruction ID: a12c524672623f7da5a39769d6717d3942eee4cb65149cf84cfd4309d1b4e461
Opcode Fuzzy Hash: 66dd76841aa96a49e1a24495d51b9d5f8c0630564c23f4d9d68afb216b954481
Instruction Fuzzy Hash: 8A618AB1608252AFD314DF55D88DB6ABFE8FF88714F000859F9859B291D770EE48CB92

Function 005CB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005CB5FC
_wcslen.LIBCMT ref: 005CB608
_wcslen.LIBCMT ref: 005CB64D
_wcslen.LIBCMT ref: 005CB68C
_wcslen.LIBCMT ref: 005CB6C7

Strings

KEYS, xrefs: 005CB647, 005CB64C
REMOVE, xrefs: 005CB602, 005CB607
EXISTS, xrefs: 005CB686, 005CB68B
APPEND, xrefs: 005CB6C1, 005CB6C6

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: d15c8c216144fe52006c316c436f9075f56ce8cfb43f91dbbb576c139fee93b2
Instruction ID: 3da6cdd28876bd6d3a10322d51c3f9e7a7c11bdd94c3732ec52e3e6dc054976a
Opcode Fuzzy Hash: d15c8c216144fe52006c316c436f9075f56ce8cfb43f91dbbb576c139fee93b2
Instruction Fuzzy Hash: EF41B932A000279EDB205FBDC992ABE7FA5BBA0754F24412DE865D7284E735CDC1C790

Function 005D5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 005D5416
GetLastError.KERNEL32 ref: 005D5420
SetErrorMode.KERNEL32(00000000,READY), ref: 005D54A7

Strings

INVALID, xrefs: 005D5459
READY, xrefs: 005D5460, 005D5468
READONLY, xrefs: 005D5452
NOTREADY, xrefs: 005D544B
UNKNOWN, xrefs: 005D5444

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9506dedacedb26fb9a8114510d25a30ce01802e1ba9677616e938c2a0eec6b92
Instruction ID: b6e59111dd1e507db9ef71671c568369f675bdfcdb09c46891b948edd08fd69c
Opcode Fuzzy Hash: 9506dedacedb26fb9a8114510d25a30ce01802e1ba9677616e938c2a0eec6b92
Instruction Fuzzy Hash: 81316D35A006099FDB20DF68C488AAA7FA4FB55305F54846BE405CB392E670DD86CB92

Function 005F3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 005F3C79
SetMenu.USER32(?,00000000), ref: 005F3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F3D10
IsMenu.USER32(?), ref: 005F3D24
CreatePopupMenu.USER32 ref: 005F3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005F3D5B
DrawMenuBar.USER32 ref: 005F3D63

Strings

F, xrefs: 005F3D4E
0, xrefs: 005F3C54

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: c10ff7b85b90f0e17c96dc890505e4e362cfbada99cbdd5a7ddd2197a9bae68c
Instruction ID: 51ecedaac468c2f7277e17deb6ebb2300e905d6c88afebf98da5c126302e503f
Opcode Fuzzy Hash: c10ff7b85b90f0e17c96dc890505e4e362cfbada99cbdd5a7ddd2197a9bae68c
Instruction Fuzzy Hash: D8416779A01209EFEB14DF64D884AAA7FB5FF49350F140428FA46E7360D738AA14DF90

Function 005C1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005C3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 005C3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 005C1F64
GetDlgCtrlID.USER32 ref: 005C1F6F
GetParent.USER32 ref: 005C1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 005C1F8E
GetDlgCtrlID.USER32(?), ref: 005C1F97
GetParent.USER32(?), ref: 005C1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 005C1FAE

Strings

ComboBox, xrefs: 005C1EEC
ListBox, xrefs: 005C1F21

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 0503ff7d40faf00fc53ee31e4e512b1a23dadbc765fc66bde30cd75a5b063ae6
Instruction ID: cf13e1097a762244d8dc03338e095ac9618acccf5bc0f89f9cc9efad981f5e2c
Opcode Fuzzy Hash: 0503ff7d40faf00fc53ee31e4e512b1a23dadbc765fc66bde30cd75a5b063ae6
Instruction Fuzzy Hash: 9B21B370900118BFCF04AFA4DD85EFEBFB9BF56310F004119B951AB291CB785918DB64

Function 005F3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 005F3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 005F3AA0
GetWindowLongW.USER32(?,000000F0), ref: 005F3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005F3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 005F3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 005F3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 005F3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 005F3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 005F3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 005F3C13

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 7793a5c16871aeb3e75404cbc34db41402e082c3b08d0b576cc20d7ac09ea6bd
Instruction ID: c79d9318914747917e64a974eced10483b07f21e08bc88874a4931281861bd1f
Opcode Fuzzy Hash: 7793a5c16871aeb3e75404cbc34db41402e082c3b08d0b576cc20d7ac09ea6bd
Instruction Fuzzy Hash: 9B615775900248AFEB10DFA8CC81EFE7BB9BF49700F104199FA15AB2A1C774AE45DB50

Function 005CB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005CB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB165
GetWindowThreadProcessId.USER32(00000000), ref: 005CB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 005CB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,005CA1E1,?,00000001), ref: 005CB21D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 758837428ff7f45109e954e9b8815869d21f8d321b6b661696c7263aa25936b4
Instruction ID: d58519d81e0f89defd8eba2a94d1c4f3e853a938da58c7af3854381c1a162ff3
Opcode Fuzzy Hash: 758837428ff7f45109e954e9b8815869d21f8d321b6b661696c7263aa25936b4
Instruction Fuzzy Hash: 3A318D75500218BFEB249FA4DD4AF7E7FAABB61311F144419FA01D6290D7B89E44CFA0

Function 00592C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00592C94

Part of subcall function 005929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000), ref: 005929DE
Part of subcall function 005929C8: GetLastError.KERNEL32(00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000,00000000), ref: 005929F0

_free.LIBCMT ref: 00592CA0
_free.LIBCMT ref: 00592CAB
_free.LIBCMT ref: 00592CB6
_free.LIBCMT ref: 00592CC1
_free.LIBCMT ref: 00592CCC
_free.LIBCMT ref: 00592CD7
_free.LIBCMT ref: 00592CE2
_free.LIBCMT ref: 00592CED
_free.LIBCMT ref: 00592CFB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 68c215d2120538b8c1408ddca7b90b63d92c7a48c07e274769d41b7fe59fb413
Instruction ID: ca14636d3ec53822a084f3adecd1ef16311b205ddcae05797692c4b8382e7c3a
Opcode Fuzzy Hash: 68c215d2120538b8c1408ddca7b90b63d92c7a48c07e274769d41b7fe59fb413
Instruction Fuzzy Hash: 3E116F76500109BFCF02EF94D986CDD3FA9BF45350F9145A5FA4C9B222DA31EA909B90

Function 00561410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00561459
OleUninitialize.OLE32(?,00000000), ref: 005614F8
UnregisterHotKey.USER32(?), ref: 005616DD
DestroyWindow.USER32(?), ref: 005A24B9
FreeLibrary.KERNEL32(?), ref: 005A251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 005A254B

Strings

close all, xrefs: 00561454

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: b58f46a4e00e95c2e6d940614c6bc41c22020e7ca3d0fc93e0f8bd63a6fb3f28
Instruction ID: 7907282c1f9f086b4ae83021e5dc5f5acc41daba4a2028682ddd5973aa5f318d
Opcode Fuzzy Hash: b58f46a4e00e95c2e6d940614c6bc41c22020e7ca3d0fc93e0f8bd63a6fb3f28
Instruction Fuzzy Hash: BCD17E31702612CFCB29EF19C599A39FFA4BF59700F1881ADE44AAB251DB30AD12CF55

Function 005D7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005D7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 005D7FC1
GetFileAttributesW.KERNEL32(?), ref: 005D7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 005D8005
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8017
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005D80B0

Strings

*.*, xrefs: 005D8066

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: d216046e520e847e9c6bb9ab2726ecac1962ab866df7495b0a60e51c70bf8e8a
Instruction ID: 3bca0cb23b2f1d1ebeeac0c4a621dbae983402cb0a52eb99f5d229e5cb8431ad
Opcode Fuzzy Hash: d216046e520e847e9c6bb9ab2726ecac1962ab866df7495b0a60e51c70bf8e8a
Instruction Fuzzy Hash: 0D817F715082499BCB30EF68C8489BABBE8FB88314F144C5BF885D7351EB34DD498B52

Function 00565BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00565C7A

Part of subcall function 00565D0A: GetClientRect.USER32(?,?), ref: 00565D30
Part of subcall function 00565D0A: GetWindowRect.USER32(?,?), ref: 00565D71
Part of subcall function 00565D0A: ScreenToClient.USER32(?,?), ref: 00565D99

GetDC.USER32 ref: 005A46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 005A4708
SelectObject.GDI32(00000000,00000000), ref: 005A4716
SelectObject.GDI32(00000000,00000000), ref: 005A472B
ReleaseDC.USER32(?,00000000), ref: 005A4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 005A47C4

Strings

U, xrefs: 005A4693

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 095b9a8ce83fc72066c065c9f67069469bf07ba188b130451f552c7ba4fa5de2
Instruction ID: 35d7e3637d3feb219762a31a0ed13a5e2ac3457880fb7907f041e128461c44fa
Opcode Fuzzy Hash: 095b9a8ce83fc72066c065c9f67069469bf07ba188b130451f552c7ba4fa5de2
Instruction Fuzzy Hash: DA71AC31400249DFCF218FA4C984ABE7FB6FF8A360F144269E9559B2A6D7718C42DF50

Function 005D359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005D35E4

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

LoadStringW.USER32(00632390,?,00000FFF,?), ref: 005D360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 005D3724
Line %d (File "%s"):, xrefs: 005D366B
^ ERROR, xrefs: 005D36C9
Error: , xrefs: 005D36EF
"%s" (%d) : ==> %s:, xrefs: 005D3742

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 9d7b6e934164cbdc53796d1f75e84e5b76056ee29d81bfdda090003352864b75
Instruction ID: d345b905ef7a77050ffbb2268e95379710035c1a089a706cf0174d2e6d58b198
Opcode Fuzzy Hash: 9d7b6e934164cbdc53796d1f75e84e5b76056ee29d81bfdda090003352864b75
Instruction Fuzzy Hash: C0514B7290060AAADB14EBA0DD4AEEEBF79BF54300F144126F105731A1EB305B98DFA1

Function 005DC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005DC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005DC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005DC2CA
GetLastError.KERNEL32 ref: 005DC322
SetEvent.KERNEL32(?), ref: 005DC336
InternetCloseHandle.WININET(00000000), ref: 005DC341

Strings

, xrefs: 005DC2BB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 59268ee55f324c07718539929c177692aa77e499da66495af45ff3b77d405d6f
Instruction ID: a0f3013affd5964adf464f5b239721b436e39097e76003db12fee460d4127877
Opcode Fuzzy Hash: 59268ee55f324c07718539929c177692aa77e499da66495af45ff3b77d405d6f
Instruction Fuzzy Hash: 4431507150120AAFD7319F698988A7B7FFCFB55744B10892FB486D2300D734D944DB61

Function 005C989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,005A3AAF,?,?,Bad directive syntax error,005FCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 005C98BC
LoadStringW.USER32(00000000,?,005A3AAF,?), ref: 005C98C3

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 005C9987

Strings

Line %d:, xrefs: 005C9912
Line %d (File "%s"):, xrefs: 005C992D
., xrefs: 005C996D
Error: , xrefs: 005C9955
%s (%d) : ==> %s.: %s %s, xrefs: 005C98F1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 482acfdc583122bac89fcf4bde08944ab6131924df6929b635fa7069053b5786
Instruction ID: dcc3b62a64d279125219a79f13db9ce7817cb82e178cd7fd630d1953ab6e363c
Opcode Fuzzy Hash: 482acfdc583122bac89fcf4bde08944ab6131924df6929b635fa7069053b5786
Instruction Fuzzy Hash: 93215E3190021EABCF15EF90DC0AEFE7B79BF58700F044469F519660A2EB759A18DB51

Function 005C209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 005C20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 005C20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 005C214D

Strings

smallicons, xrefs: 005C2115
list, xrefs: 005C212F
largeicons, xrefs: 005C20E1
SHELLDLL_DefView, xrefs: 005C20CC
details, xrefs: 005C20FB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: c89c935601b14a2e349e22fb6868e91ac545bc378b4d43a359e5430f6e6104af
Instruction ID: d8771760ed985fade0bc65ed724d5fb98d7a99f4ada845c9a7e606f1b9077903
Opcode Fuzzy Hash: c89c935601b14a2e349e22fb6868e91ac545bc378b4d43a359e5430f6e6104af
Instruction Fuzzy Hash: 7F11277A688717BEF6156260EC0AEA63F9DEB14325F20002EFF05F80D1EA7158419E14

Function 0059CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0059CEB7
_free.LIBCMT ref: 0059CF22
_free.LIBCMT ref: 0059CF48
_free.LIBCMT ref: 0059CF71
_free.LIBCMT ref: 0059CFA9
_free.LIBCMT ref: 0059CFDA
_free.LIBCMT ref: 0059D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0059D09C
_free.LIBCMT ref: 0059D0B5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 8ed624907fe09b353f6a299bf0554ede2bb87eddb21dc50137237f4872272fc5
Instruction ID: 42d8bb958711c95399c5ebcd114a0598c413b1dba95c1fc0341f0a2492529787
Opcode Fuzzy Hash: 8ed624907fe09b353f6a299bf0554ede2bb87eddb21dc50137237f4872272fc5
Instruction Fuzzy Hash: C5614671904302AFDF21AFB49899A7A7FE6FF45360F04416DF945A7282E7319D01CBA0

Function 005F50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 005F5186
ShowWindow.USER32(?,00000000), ref: 005F51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 005F51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 005F51D1

Part of subcall function 005F6FBA: DeleteObject.GDI32(00000000), ref: 005F6FE6

GetWindowLongW.USER32(?,000000F0), ref: 005F520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005F521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 005F524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 005F5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 005F5296

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 77d7860993e7098374d526d818548064c00b7b4f701124656b48c4fcc0554ab1
Instruction ID: 92ccab77292fbfac566659586c328a77ab2eada71b32c56f8923bfe8e2c55bb2
Opcode Fuzzy Hash: 77d7860993e7098374d526d818548064c00b7b4f701124656b48c4fcc0554ab1
Instruction Fuzzy Hash: 32517D34A40A0DBEEF249F24CC49FB93F65FB45321F148211F7559A2E0E779A984EB40

Function 00578B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 005B6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 005B68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 005B68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 005B68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 005B68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00578874,00000000,00000000,00000000,000000FF,00000000), ref: 005B6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005B691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00578874,00000000,00000000,00000000,000000FF,00000000), ref: 005B692D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 32605ef78a3ee931000e4e1c8c00e9bda1c2f5619cc907a63d0598fb5eb5ddab
Instruction ID: b5562fe7c3781828d8dc2e80da3a327120576d9b910055320bea173a3ecf3521
Opcode Fuzzy Hash: 32605ef78a3ee931000e4e1c8c00e9bda1c2f5619cc907a63d0598fb5eb5ddab
Instruction Fuzzy Hash: 89515970600209EFDB20CF25DC59BBA7FB6FB58750F108528F95ADA2A0DB74A950EB50

Function 005DC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005DC182
GetLastError.KERNEL32 ref: 005DC195
SetEvent.KERNEL32(?), ref: 005DC1A9

Part of subcall function 005DC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005DC272
Part of subcall function 005DC253: GetLastError.KERNEL32 ref: 005DC322
Part of subcall function 005DC253: SetEvent.KERNEL32(?), ref: 005DC336
Part of subcall function 005DC253: InternetCloseHandle.WININET(00000000), ref: 005DC341

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: d7724f8384ba4818c2ab461ac581bc7c3aaf6197491c66dd702bd86c19830e7a
Instruction ID: 3a47985029b1b7e480a6883b707de3ba8035984867fd4180530b0dfd008b5996
Opcode Fuzzy Hash: d7724f8384ba4818c2ab461ac581bc7c3aaf6197491c66dd702bd86c19830e7a
Instruction Fuzzy Hash: 46316B75201606AFDB319FA99D44A76BFE9FF68300B10482FF996C2710D735E814EB60

Function 005C25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005C3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005C3A57
Part of subcall function 005C3A3D: GetCurrentThreadId.KERNEL32 ref: 005C3A5E
Part of subcall function 005C3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005C25B3), ref: 005C3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 005C25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005C25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 005C25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 005C25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 005C2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 005C2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 005C260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 005C2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 005C2627

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: ac1cf334c54c6a2497c0a2dd4c98e20da2f6cd37191f578da0a1d535664db0db
Instruction ID: 6833ec50d30076b16156f87360647b8f080ae94cd0d5085cad500ec2c5677d6a
Opcode Fuzzy Hash: ac1cf334c54c6a2497c0a2dd4c98e20da2f6cd37191f578da0a1d535664db0db
Instruction Fuzzy Hash: 0B01D430394218BBFB1067A99C8EF693F59EF9EB12F100415F318EE0D1C9F26458DA69

Function 005C1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,005C1449,?,?,00000000), ref: 005C180C
HeapAlloc.KERNEL32(00000000,?,005C1449,?,?,00000000), ref: 005C1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005C1449,?,?,00000000), ref: 005C1828
GetCurrentProcess.KERNEL32(?,00000000,?,005C1449,?,?,00000000), ref: 005C1830
DuplicateHandle.KERNEL32(00000000,?,005C1449,?,?,00000000), ref: 005C1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005C1449,?,?,00000000), ref: 005C1843
GetCurrentProcess.KERNEL32(005C1449,00000000,?,005C1449,?,?,00000000), ref: 005C184B
DuplicateHandle.KERNEL32(00000000,?,005C1449,?,?,00000000), ref: 005C184E
CreateThread.KERNEL32(00000000,00000000,005C1874,00000000,00000000,00000000), ref: 005C1868

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: afb417a7b6954cc93a1080408ef60fd72168cbe02247c219d5d0d3f248a16d26
Instruction ID: 89689582ce9ae3c34e49cfa8662e1f0442834f5465c03171963fe74345c4cbcf
Opcode Fuzzy Hash: afb417a7b6954cc93a1080408ef60fd72168cbe02247c219d5d0d3f248a16d26
Instruction Fuzzy Hash: 0E01BBB5240308BFE710ABA5DD4DF6B3FACEB99B11F004421FA05DB1A2CA749814EB60

Function 00593E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00593F0B
__alldvrm.LIBCMT ref: 0059410C
__alldvrm.LIBCMT ref: 0059412E

Strings

}}X, xrefs: 005940CD
}}X, xrefs: 00593E96, 00593EF1, 00593F0A, 00594090
}}X, xrefs: 00593E8A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}X$}}X$}}X
API String ID: 1036877536-1460148507
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 2c771323905a448db334ed0c31df1380d48c6009b8de061bd8e73314131a0ebd
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: C5A12676E007869FDF25CE18C895BAEBFE5FF65350F18416DE5859B281C2388D82CB50

Function 0056BBE0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0056BEB3

Strings

`g, xrefs: 0056BC10
D%c, xrefs: 0056BDED, 0056BD91, 0056BD1B
D%c, xrefs: 0056BE9A
D%c, xrefs: 0056BCA2
x[, xrefs: 0056BC1B, 0056BCC7
D%cD%c, xrefs: 0056BCA5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%c$D%c$D%c$D%cD%c$`g$x[
API String ID: 1385522511-3785109894
Opcode ID: 42a09815b0095898d18672c69af274cb166c08299e6d0748f981b8e2d3282020
Instruction ID: 27dbd73f216ad393d30ec67c13482b24a031c3d19e5f3d2ed23ee1cca4b12534
Opcode Fuzzy Hash: 42a09815b0095898d18672c69af274cb166c08299e6d0748f981b8e2d3282020
Instruction Fuzzy Hash: 2F911975A0020ADFEB58CF58C0916AABBF2FF58314F248569D945EB351E731AE81CB90

Function 005E7B7E Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00580242: EnterCriticalSection.KERNEL32(0063070C,00631884,?,?,0057198B,00632518,?,?,?,005612F9,00000000), ref: 0058024D
Part of subcall function 00580242: LeaveCriticalSection.KERNEL32(0063070C,?,0057198B,00632518,?,?,?,005612F9,00000000), ref: 0058028A

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005800A3: __onexit.LIBCMT ref: 005800A9

__Init_thread_footer.LIBCMT ref: 005E7BFB

Part of subcall function 005801F8: EnterCriticalSection.KERNEL32(0063070C,?,?,00578747,00632514), ref: 00580202
Part of subcall function 005801F8: LeaveCriticalSection.KERNEL32(0063070C,?,00578747,00632514), ref: 00580235

Strings

Variable must be of type 'Object'., xrefs: 005E7C3A
`g, xrefs: 005E7D5C, 005E7C50
5, xrefs: 005E7C78
+T[, xrefs: 005E7E2E
G`g, xrefs: 005E7C96
G`g, xrefs: 005E7CD4, 005E7D73, 005E7D05, 005E7E05

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T[$5$G`g$G`g$Variable must be of type 'Object'.$`g
API String ID: 535116098-4066076899
Opcode ID: e37f664985d43b0a8b242791a42f90753fb98e2ad0dbb990b48cba1050ee0f7c
Instruction ID: 101a23a131ff920054283e71afb645af72a1abaaf8eab9cd08471402c8dde32e
Opcode Fuzzy Hash: e37f664985d43b0a8b242791a42f90753fb98e2ad0dbb990b48cba1050ee0f7c
Instruction Fuzzy Hash: 5991AF70A0424AEFCB08EF55D9949BDBFB6FF88304F108059F886AB291DB719E41CB51

Function 005EA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 005CD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 005CD501
Part of subcall function 005CD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 005CD50F
Part of subcall function 005CD4DC: CloseHandle.KERNEL32(00000000), ref: 005CD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 005EA16D
GetLastError.KERNEL32 ref: 005EA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 005EA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 005EA268
GetLastError.KERNEL32(00000000), ref: 005EA273
CloseHandle.KERNEL32(00000000), ref: 005EA2C4

Strings

SeDebugPrivilege, xrefs: 005EA18F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: e774e00060a09d8faa0820462c0983235bde8bc1b18d6eeee024d662ee17d4eb
Instruction ID: 9fad3e8f3eb2a7baa9d5718ade3f0e225a0c1852f8d9a83d369f866f089308fe
Opcode Fuzzy Hash: e774e00060a09d8faa0820462c0983235bde8bc1b18d6eeee024d662ee17d4eb
Instruction Fuzzy Hash: 56618C342042829FD718DF25C498F25BFA1BF94318F14849CE5968B7A3C776EC49CB92

Function 005F3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 005F3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 005F393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 005F3954
_wcslen.LIBCMT ref: 005F3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 005F39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 005F39F4

Strings

SysListView32, xrefs: 005F38F7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 8874fa5ca0a07617676fafdc30fa0b2e14fd0c628b5e0a2c111d1617abc087ff
Instruction ID: f6ff9e4ed182b662d4699c555d18de4550f6410bbf9c3ea4116c83f0214a460a
Opcode Fuzzy Hash: 8874fa5ca0a07617676fafdc30fa0b2e14fd0c628b5e0a2c111d1617abc087ff
Instruction Fuzzy Hash: 8441857190021DABEB219F64CC49FFA7FA9FF48350F100526FA54E7291D7B99984CB90

Function 005CBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005CBCFD
IsMenu.USER32(00000000), ref: 005CBD1D
CreatePopupMenu.USER32 ref: 005CBD53
GetMenuItemCount.USER32(00E65DA8), ref: 005CBDA4
InsertMenuItemW.USER32(00E65DA8,?,00000001,00000030), ref: 005CBDCC

Strings

2, xrefs: 005CBD37
0, xrefs: 005CBCA8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: cb489663798243483f3a2e1c470e6d9a859bbf22965b4710439470ec9e9cbfa2
Instruction ID: eae3608e439d67b5e7b8a602a682cdc0073c88acce2ced77903f6ccb3f1b3e0c
Opcode Fuzzy Hash: cb489663798243483f3a2e1c470e6d9a859bbf22965b4710439470ec9e9cbfa2
Instruction Fuzzy Hash: 8D517A70A0020A9FEB10DFE8D98AFAEBFF8BF95314F14456DE402A7290D7719945CB61

Function 00582D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00582D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00582D53
_ValidateLocalCookies.LIBCMT ref: 00582DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00582E0C
_ValidateLocalCookies.LIBCMT ref: 00582E61

Strings

csm, xrefs: 00582DF6
&HX, xrefs: 00582DFE, 00582E07, 00582E18

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &HX$csm
API String ID: 1170836740-4108283372
Opcode ID: e47a7300e9c795090b4a64a6902976b100cf60f5b3218fa055505c2154bd2b55
Instruction ID: aefa99d99700fb7bb7a7114cf33b87dc98029eb3aad61172682a55b89f96bede
Opcode Fuzzy Hash: e47a7300e9c795090b4a64a6902976b100cf60f5b3218fa055505c2154bd2b55
Instruction Fuzzy Hash: 25418334A01209ABCF10EF68C849AAEBFB5BF85324F148155EC15BB392D7759A06CF90

Function 005CC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 005CC913

Strings

question, xrefs: 005CC8CC
warning, xrefs: 005CC8FC
blank, xrefs: 005CC895
info, xrefs: 005CC8B4
stop, xrefs: 005CC8E4

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a8315b3d791f425899e11d8a5380b518577a41536edfea12c8831ba9f9d75734
Instruction ID: e55070751b08b827dbc4b57c5a9a07a1653e0e1727dedf806e5a8dabe2de5214
Opcode Fuzzy Hash: a8315b3d791f425899e11d8a5380b518577a41536edfea12c8831ba9f9d75734
Instruction Fuzzy Hash: 4F112B31689717BEA704AB94EC82EAB2FACFF15754B10002EF908A6182D7B0AD405765

Function 005CDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 005CDE42
gethostname.WSOCK32(?,00000100), ref: 005CDE5C
gethostbyname.WSOCK32(?), ref: 005CDE69
inet_ntoa.WSOCK32(?), ref: 005CDEAB
_strcat.LIBCMT ref: 005CDEB9
WSACleanup.WSOCK32 ref: 005CDEDE

Strings

0.0.0.0, xrefs: 005CDE87

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 96c0427c2759379350bc2e1a6718b7255e7df152f3b44789aa8f64a909c3e4ad
Instruction ID: bc49c830181aa184064e85c35d5c415e1cad015f55030f763c2e265b8f4d0780
Opcode Fuzzy Hash: 96c0427c2759379350bc2e1a6718b7255e7df152f3b44789aa8f64a909c3e4ad
Instruction Fuzzy Hash: DE11C33150411AAFCB20BB609C0AEEA7FBCEB54710F01017DF905E6091EF748A859B60

Function 005CED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 005CED2A
_wcslen.LIBCMT ref: 005CED3B
_wcslen.LIBCMT ref: 005CED79
_wcslen.LIBCMT ref: 005CEDAF
_wcslen.LIBCMT ref: 005CEDDF
_wcslen.LIBCMT ref: 005CEDEF
_wcslen.LIBCMT ref: 005CEE2B
_wcslen.LIBCMT ref: 005CEE5A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: fa8200e2f5102f1302869f229465a9ca9351425342fa71c72e654a5874a8c200
Instruction ID: f2ed4364da38b7fdb09eee5c78125eccd87ebbe03aadf4bfe6fc428ca8a849c8
Opcode Fuzzy Hash: fa8200e2f5102f1302869f229465a9ca9351425342fa71c72e654a5874a8c200
Instruction Fuzzy Hash: 11419365C1011A66CB21FBF4888FADF7BACBF85310F504466E919F3162EB34D245C7A5

Function 0057F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,005B682C,00000004,00000000,00000000), ref: 0057F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,005B682C,00000004,00000000,00000000), ref: 005BF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,005B682C,00000004,00000000,00000000), ref: 005BF454

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 89ee1371180250fa140b38f8790f9ce0c13585a131733b460bcd6d0183e4b5d6
Instruction ID: bffd1e02cb99ac20e8718ea6627e7cc792107ddc71b4624a32b5024aa37b7053
Opcode Fuzzy Hash: 89ee1371180250fa140b38f8790f9ce0c13585a131733b460bcd6d0183e4b5d6
Instruction Fuzzy Hash: F7412B31608640BAC735DF2DED887BA7F92BB96314F14C83CE24F96560D635A884FB11

Function 005F2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 005F2D1B
GetDC.USER32(00000000), ref: 005F2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 005F2D2E
ReleaseDC.USER32(00000000,00000000), ref: 005F2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 005F2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 005F2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,005F5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 005F2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 005F2DE1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 6feb8fdca534ec953fd31dcf0b8b749f5ae2dae7ab5ce6d8e9d5af5ef07ae6f1
Instruction ID: d612d8ee303a5c12206dd189ff2e7b07ffddaae483b9e43d8983508f3c7de590
Opcode Fuzzy Hash: 6feb8fdca534ec953fd31dcf0b8b749f5ae2dae7ab5ce6d8e9d5af5ef07ae6f1
Instruction Fuzzy Hash: F0317872241618ABEB218F54CC8AFBB3FADFB19711F044065FE08DA291C6799855CBA0

Function 005C5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 005C5637
_memcmp.LIBVCRUNTIME ref: 005C5659
_memcmp.LIBVCRUNTIME ref: 005C5671
_memcmp.LIBVCRUNTIME ref: 005C5684
_memcmp.LIBVCRUNTIME ref: 005C569E
_memcmp.LIBVCRUNTIME ref: 005C56B1
_memcmp.LIBVCRUNTIME ref: 005C56C9
_memcmp.LIBVCRUNTIME ref: 005C56E4

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a0b3783390cd0e2bbaf40e97df9aa5a3340a02d8a519b8168968cd4966ac7d10
Instruction ID: aa20ea36706c9ee7b01e6d59761faf1e2b3561429a0aade1b5b9f377c9437534
Opcode Fuzzy Hash: a0b3783390cd0e2bbaf40e97df9aa5a3340a02d8a519b8168968cd4966ac7d10
Instruction Fuzzy Hash: 7821C861644D1A7F961465D08D86FBA3F5CFE51384B440428FE066A941FB24FDD183A9

Function 005E4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 005E502E, 005E5383
Not an Object type, xrefs: 005E5007

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 8d66d641f67864a6e671b0f7c3bd07deaad44fc8a7a1a59fc9df23823dca1ab1
Instruction ID: bf8153b19f29b89c28a7904cb077a80e032b6bfcc648847a2991a2c88b90de95
Opcode Fuzzy Hash: 8d66d641f67864a6e671b0f7c3bd07deaad44fc8a7a1a59fc9df23823dca1ab1
Instruction Fuzzy Hash: E7D1E375A0064A9FDF18CFA9C884FAEBBB5BF48308F148469E955AB281E370DD45CB50

Function 005A1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 005A15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 005A1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005A16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 005A16FB

Part of subcall function 00593820: RtlAllocateHeap.NTDLL(00000000,?,00631444,?,0057FDF5,?,?,0056A976,00000010,00631440,005613FC,?,005613C6,?,00561129), ref: 00593852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005A1777
__freea.LIBCMT ref: 005A17A2
__freea.LIBCMT ref: 005A17AE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: c7b6f72ae4121885a765ac765971fdac010d5310e2d08b872dfe34a2fafe8029
Instruction ID: 0335b5f4391c94fb30cddc7622f3693a80d2d609abe1fe1d9381a59d9f6d79d3
Opcode Fuzzy Hash: c7b6f72ae4121885a765ac765971fdac010d5310e2d08b872dfe34a2fafe8029
Instruction Fuzzy Hash: 8A91C471E00A169ADF248E74C985EEE7FB5FF8A310F184669E902E7181DB35DC44CB68

Function 005E4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005E4648
VariantInit.OLEAUT32(?), ref: 005E4749
VariantClear.OLEAUT32(?), ref: 005E4753
VariantClear.OLEAUT32(?), ref: 005E47B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 005E45D8, 005E4706, 005E47BE
Incorrect Object type in FOR..IN loop, xrefs: 005E472C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: a9c126dd058c29a77e19a88df2b8ffef4aaa0137ed7d7ac26fa515f3d1fdc891
Instruction ID: 552461128cb0af8ade3e5f4270bbb3546108416a479989d7625a283a03b2315a
Opcode Fuzzy Hash: a9c126dd058c29a77e19a88df2b8ffef4aaa0137ed7d7ac26fa515f3d1fdc891
Instruction Fuzzy Hash: B891B470A00259ABDF24CFA6D848FAEBFB9FF86710F108559F545AB280D7709945CFA0

Function 005D1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 005D125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 005D1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 005D12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005D12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005D135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005D13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005D1430

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 2b3beb1e16c27c10c165b8ed0917a5bb2e6f8f9d086d11ccb9332974b4701f0b
Instruction ID: 6e1660ed399e81ed6bd20fda010a8f6cbecf51cd851e73202a5867d8c8880452
Opcode Fuzzy Hash: 2b3beb1e16c27c10c165b8ed0917a5bb2e6f8f9d086d11ccb9332974b4701f0b
Instruction Fuzzy Hash: 0891F275A00619AFDB20DF99C888BBEBBB5FF84315F10442BE900EB391D775A941CB94

Function 0057948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 0908c83cbc40fa2520586dc1a9e2f607f117960f4d79905a1ff43b38aa6e7158
Instruction ID: 57e32da801368af47016ae23b38aabc523877b1c7cb0f2e4062495f88c3480c0
Opcode Fuzzy Hash: 0908c83cbc40fa2520586dc1a9e2f607f117960f4d79905a1ff43b38aa6e7158
Instruction Fuzzy Hash: AE912671D0021AEFCB10CFA9D888AEEBFB8FF89320F148555E515B7251D778A942DB60

Function 005E3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005E396B
CharUpperBuffW.USER32(?,?), ref: 005E3A7A
_wcslen.LIBCMT ref: 005E3A8A
VariantClear.OLEAUT32(?), ref: 005E3C1F

Part of subcall function 005D0CDF: VariantInit.OLEAUT32(00000000), ref: 005D0D1F
Part of subcall function 005D0CDF: VariantCopy.OLEAUT32(?,?), ref: 005D0D28
Part of subcall function 005D0CDF: VariantClear.OLEAUT32(?), ref: 005D0D34

Strings

Incorrect Parameter format, xrefs: 005E39A6, 005E3BA1
AUTOIT.ERROR, xrefs: 005E3A80, 005E3A85

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: f0ef2bb37cce8c54b3b8f0e38f9981b17f7cced24454b9b5f2808c777fab31d3
Instruction ID: 84773aae8646a143a790cbb90863142e3fdfeaa377f3234929983db00af4f231
Opcode Fuzzy Hash: f0ef2bb37cce8c54b3b8f0e38f9981b17f7cced24454b9b5f2808c777fab31d3
Instruction Fuzzy Hash: 529147746083469FC704DF25C48996ABBE9FF88314F14886EF88A97351DB31EE45CB92

Function 005E4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 005C000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?,?,005C035E), ref: 005C002B
Part of subcall function 005C000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?), ref: 005C0046
Part of subcall function 005C000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?), ref: 005C0054
Part of subcall function 005C000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?), ref: 005C0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 005E4C51
_wcslen.LIBCMT ref: 005E4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 005E4DCF
CoTaskMemFree.OLE32(?), ref: 005E4DDA

Strings

NULL Pointer assignment, xrefs: 005E4E23, 005E4E52

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 79f5ff98c769ca90377ec5fbef4a5a023eabd602a73e92b55d0e2f57d6f13381
Instruction ID: ac69e7ef515faa39fb78c7ba2c440b7ae63e78e98916fd8187b0e99431724622
Opcode Fuzzy Hash: 79f5ff98c769ca90377ec5fbef4a5a023eabd602a73e92b55d0e2f57d6f13381
Instruction Fuzzy Hash: D9913771D0025DAFDF14DFA5C885AEEBBB8BF48300F108569E955B7291DB349A44CF60

Function 005F20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 005F2183
GetMenuItemCount.USER32(00000000), ref: 005F21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 005F21DD
_wcslen.LIBCMT ref: 005F2213
GetMenuItemID.USER32(?,?), ref: 005F224D
GetSubMenu.USER32(?,?), ref: 005F225B

Part of subcall function 005C3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005C3A57
Part of subcall function 005C3A3D: GetCurrentThreadId.KERNEL32 ref: 005C3A5E
Part of subcall function 005C3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005C25B3), ref: 005C3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 005F22E3

Part of subcall function 005CE97B: Sleep.KERNELBASE ref: 005CE9F3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 75bfe61377f1e2777a0716e9b0130b53b58830f59ce04a451afaa0b3968a373d
Instruction ID: 753e6eb1c520076c1b43653c08524085a48c4f1a6085c2eee4d4f3e7b61b4c70
Opcode Fuzzy Hash: 75bfe61377f1e2777a0716e9b0130b53b58830f59ce04a451afaa0b3968a373d
Instruction Fuzzy Hash: 21713F75A00209AFCB14DFA4C845ABEBFB5BF88310F148459E956EB351DB38AD41CB90

Function 005F7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E65BF0), ref: 005F7F37
IsWindowEnabled.USER32(00E65BF0), ref: 005F7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 005F801E
SendMessageW.USER32(00E65BF0,000000B0,?,?), ref: 005F8051
IsDlgButtonChecked.USER32(?,?), ref: 005F8089
GetWindowLongW.USER32(00E65BF0,000000EC), ref: 005F80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 005F80C3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c60f306f78282aa13c6a300c2bee9847de26f0e9cb74b18ba21a91b408bc7797
Instruction ID: 263e256e7fd3f0affadf8d507bd794d418680f5d655d22e778c20b7c6b77dcb9
Opcode Fuzzy Hash: c60f306f78282aa13c6a300c2bee9847de26f0e9cb74b18ba21a91b408bc7797
Instruction Fuzzy Hash: 40718F3460824DAFEB219F64C888FFA7FBAFF5D300F144459EA55972A1CB39A845DB10

Function 005CAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 005CAEF9
GetKeyboardState.USER32(?), ref: 005CAF0E
SetKeyboardState.USER32(?), ref: 005CAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 005CAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 005CAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 005CAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 005CB020

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b64452f04d56740da0771c2f8e77e3751ce80326cd4890461b4158f65d355658
Instruction ID: a65193e66771129db7e2e414482e28759300a1e82e2523a3cebf7b7db0742e4c
Opcode Fuzzy Hash: b64452f04d56740da0771c2f8e77e3751ce80326cd4890461b4158f65d355658
Instruction Fuzzy Hash: CA5184A06047D93DFB3652B48C4AFBA7EA96B06308F08858DE1D5954C3D3E9ACC8D752

Function 005CACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 005CAD19
GetKeyboardState.USER32(?), ref: 005CAD2E
SetKeyboardState.USER32(?), ref: 005CAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 005CADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 005CADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 005CAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 005CAE38

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6194e1fc575d3e47a0d2849bf5355dcb58b5f9407d8994368598aa5ba1c03b4e
Instruction ID: 8b444c9de8d3f7cabe68c861ee0681c39c8110f540472eb08e8d6b8c43c2b438
Opcode Fuzzy Hash: 6194e1fc575d3e47a0d2849bf5355dcb58b5f9407d8994368598aa5ba1c03b4e
Instruction Fuzzy Hash: A251E7A15047D93DFB3783B48C55F7A7EA97B45308F08848CE1D6868C3D294EC88E792

Function 0059542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(005A3CD6,?,?,?,?,?,?,?,?,00595BA3,?,?,005A3CD6,?,?), ref: 00595470
__fassign.LIBCMT ref: 005954EB
__fassign.LIBCMT ref: 00595506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,005A3CD6,00000005,00000000,00000000), ref: 0059552C
WriteFile.KERNEL32(?,005A3CD6,00000000,00595BA3,00000000,?,?,?,?,?,?,?,?,?,00595BA3,?), ref: 0059554B
WriteFile.KERNEL32(?,?,00000001,00595BA3,00000000,?,?,?,?,?,?,?,?,?,00595BA3,?), ref: 00595584

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b14683ebb0c3d7258849e248cc3cd84f58a45d2f16ebbf1f9e49c5312d19d77f
Instruction ID: 095e79fc5927a88bc4836c528bddf10041e2658d43ea3294002f3d2a4476305d
Opcode Fuzzy Hash: b14683ebb0c3d7258849e248cc3cd84f58a45d2f16ebbf1f9e49c5312d19d77f
Instruction Fuzzy Hash: 2151BF70A006099FDF11CFA8D845AEEBFF9FF09300F15451AE955E7292E630AA51CBA0

Function 00592051 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005920C3
_free.LIBCMT ref: 005920E3

Strings

`g, xrefs: 00592076, 005920B8, 005920D8, 00592158

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free
String ID: `g
API String ID: 269201875-2379392305
Opcode ID: 211082d5ea4ee1b1de9d4cef8fd5024214b187977914a477273fd67c14e90465
Instruction ID: 81b04efb224bd0447e1acbce34d635b871bcf33bb0f772ed2d18c54305dac746
Opcode Fuzzy Hash: 211082d5ea4ee1b1de9d4cef8fd5024214b187977914a477273fd67c14e90465
Instruction Fuzzy Hash: 2741B232A00200AFCF24DF78C885A5DBBA5FF89314F158569E919EB352D631AD01DB81

Function 005E10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 005E304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 005E307A
Part of subcall function 005E304E: _wcslen.LIBCMT ref: 005E309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 005E1112
WSAGetLastError.WSOCK32 ref: 005E1121
WSAGetLastError.WSOCK32 ref: 005E11C9
closesocket.WSOCK32(00000000), ref: 005E11F9

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: ca11217800c86aafa9fa9a4b68ed01092ab2d8c76ad431cd487adfed22151d51
Instruction ID: 9321066c38229fa60df9b7b3195c239c1a0884b390d5f53d95395da2ad8499bc
Opcode Fuzzy Hash: ca11217800c86aafa9fa9a4b68ed01092ab2d8c76ad431cd487adfed22151d51
Instruction Fuzzy Hash: DE412431200648AFDB189F15C888BA9BFE9FF85364F148069F986DB291C774AD45CBA4

Function 005CCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005CCF22,?), ref: 005CDDFD

Part of subcall function 005CDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005CCF22,?), ref: 005CDE16

lstrcmpiW.KERNEL32(?,?), ref: 005CCF45
MoveFileW.KERNEL32(?,?), ref: 005CCF7F
_wcslen.LIBCMT ref: 005CD005
_wcslen.LIBCMT ref: 005CD01B
SHFileOperationW.SHELL32(?), ref: 005CD061

Strings

\*.*, xrefs: 005CCFF3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 39853de9a9e24efd1da694fb38a99a5e98417b6abac730a00bc0840a4d98bb20
Instruction ID: 9e11eab9ae84abd5efaccce0c945e8d8ef31a5584c18e7689cef7d7ee0a45c40
Opcode Fuzzy Hash: 39853de9a9e24efd1da694fb38a99a5e98417b6abac730a00bc0840a4d98bb20
Instruction Fuzzy Hash: 224144719052195EDF12EBE4C985FDDBFB9BF48380F0000EAE509EB141EA34A688CB50

Function 005F2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 005F2E1C
GetWindowLongW.USER32(?,000000F0), ref: 005F2E4F
GetWindowLongW.USER32(?,000000F0), ref: 005F2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 005F2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 005F2EE0
GetWindowLongW.USER32(?,000000F0), ref: 005F2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005F2F0B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c000e174d9ed0a559f377e1f52dd32e9f36ad1fbcdc79c423eecdf92662f76ff
Instruction ID: cd7456a2abd01f8f4f19f3fd754e37ebf821873e685258aa919554186a2a85af
Opcode Fuzzy Hash: c000e174d9ed0a559f377e1f52dd32e9f36ad1fbcdc79c423eecdf92662f76ff
Instruction Fuzzy Hash: B1311270644248AFEB208F18DD84F753BEAFB9A710F250164FA04CF2B1CB79A844EB40

Function 005C7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C778F
SysAllocString.OLEAUT32(00000000), ref: 005C7792
SysAllocString.OLEAUT32(?), ref: 005C77B0
SysFreeString.OLEAUT32(?), ref: 005C77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 005C77DE
SysAllocString.OLEAUT32(?), ref: 005C77EC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b3ebb03b739f88a9c1107bca934b939565e6d00b9e8a68d567e78b903d0c471e
Instruction ID: ba973f58fd2c07f6625b1025dc6370fb566dacc59e2a95dc47c12f7b09817811
Opcode Fuzzy Hash: b3ebb03b739f88a9c1107bca934b939565e6d00b9e8a68d567e78b903d0c471e
Instruction Fuzzy Hash: 92219C7A60821DAFDF10DFA8DC88EBB7BECFB093647008429BA14DB190D6749C45DB64

Function 005C77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C7868
SysAllocString.OLEAUT32(00000000), ref: 005C786B
SysAllocString.OLEAUT32 ref: 005C788C
SysFreeString.OLEAUT32 ref: 005C7895
StringFromGUID2.OLE32(?,?,00000028), ref: 005C78AF
SysAllocString.OLEAUT32(?), ref: 005C78BD

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b1194cc4de3c927d50ef0a6c02da360b32f9005f6e0b602a1f637a085b21d97e
Instruction ID: 4a82250dd383b6091c2c0723ff1461e016f0255821e2e197fd6e021946023378
Opcode Fuzzy Hash: b1194cc4de3c927d50ef0a6c02da360b32f9005f6e0b602a1f637a085b21d97e
Instruction Fuzzy Hash: FE215E31608208AF9F109BE8DC8DEBA7BACFB0D7607108129BA15CB2A1D674DC45DB64

Function 005D04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 005D04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005D052E

Strings

nul, xrefs: 005D0567

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: f936237cf42bab4e1db6e47a55d2cb8671c8ab6fa2f2d0af9a5921fd3a8359c8
Instruction ID: 36f0a51ec7b3ab1f9742c4146ff33efb3ffc4dd922ee80ee27f0c35345fa4a6f
Opcode Fuzzy Hash: f936237cf42bab4e1db6e47a55d2cb8671c8ab6fa2f2d0af9a5921fd3a8359c8
Instruction Fuzzy Hash: 07212A75900205EBDF309F29E845BAA7BA4BF94724F204A2BECA1D62E0D7709954DF20

Function 005D05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005D05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005D0601

Strings

nul, xrefs: 005D0639

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ae525ae49ecf6f4d2e35c351aecab0b5d35efaf3dcc9886d2b875427ee31cf3d
Instruction ID: 165666cbfc2c2ac4e470a10b621006538aadb5d79b8af6f6a30d778c288653e3
Opcode Fuzzy Hash: ae525ae49ecf6f4d2e35c351aecab0b5d35efaf3dcc9886d2b875427ee31cf3d
Instruction Fuzzy Hash: CE213B755002059BDB309F6D9804BAA7BA8BF95720F201A1BE8A1E73E0D7B0D964DB20

Function 005F40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0056604C
Part of subcall function 0056600E: GetStockObject.GDI32(00000011), ref: 00566060
Part of subcall function 0056600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0056606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 005F4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 005F411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 005F412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 005F4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 005F4145

Strings

Msctls_Progress32, xrefs: 005F40E3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: a08e0c29b0025c0d05da3f57a9bee1fa69dce72900f0e6c381887ead6f0ba37c
Instruction ID: bb98c4ec16b073820d0ba9d55c9e08062d6e1011891260a4b4db69c17190aff9
Opcode Fuzzy Hash: a08e0c29b0025c0d05da3f57a9bee1fa69dce72900f0e6c381887ead6f0ba37c
Instruction Fuzzy Hash: 92118EB214021EBEEB118E64CC85EF77F6DFF087A8F014110BB18A6050CA769C21DBA4

Function 0059D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0059D7A3: _free.LIBCMT ref: 0059D7CC

_free.LIBCMT ref: 0059D82D

Part of subcall function 005929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000), ref: 005929DE
Part of subcall function 005929C8: GetLastError.KERNEL32(00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000,00000000), ref: 005929F0

_free.LIBCMT ref: 0059D838
_free.LIBCMT ref: 0059D843
_free.LIBCMT ref: 0059D897
_free.LIBCMT ref: 0059D8A2
_free.LIBCMT ref: 0059D8AD
_free.LIBCMT ref: 0059D8B8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 4283eaeda1d341cb139cc0301b7d0466f59015d99e55431e6e464c2e274bca8c
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 7E11F671940B05BADE21BFF0CC4AFCB7FACBF84700F404825B29DA6492DA69A54586B0

Function 005CDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 005CDA74
LoadStringW.USER32(00000000), ref: 005CDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 005CDA91
LoadStringW.USER32(00000000), ref: 005CDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 005CDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 005CDAB9

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 1a0e69359a5d5e15225909b5d0efc6ea21d4a3b0553f54ea77ee2000c8a8ae57
Instruction ID: 44ff59917e4260d279b7c436addb7c129d1e2f2458c89da24d57f83188ecde1f
Opcode Fuzzy Hash: 1a0e69359a5d5e15225909b5d0efc6ea21d4a3b0553f54ea77ee2000c8a8ae57
Instruction Fuzzy Hash: A40162F250420C7FEB10ABE49E89EFB7A6CE708701F4044A5B746E2041E6789E888F74

Function 005D096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00E5D140,00E5D140), ref: 005D097B
EnterCriticalSection.KERNEL32(00E5D120,00000000), ref: 005D098D
TerminateThread.KERNEL32(?,000001F6), ref: 005D099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 005D09A9
CloseHandle.KERNEL32(?), ref: 005D09B8
InterlockedExchange.KERNEL32(00E5D140,000001F6), ref: 005D09C8
LeaveCriticalSection.KERNEL32(00E5D120), ref: 005D09CF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 19b4fafd0c5838f794884ed6413ed24f7e2c8b81c41c3b4060ee1724e2bdb602
Instruction ID: 97b746b02e9c6c4dd1bf2be9d89d1d6cdcabe8900c8780d64edcb9e62f747979
Opcode Fuzzy Hash: 19b4fafd0c5838f794884ed6413ed24f7e2c8b81c41c3b4060ee1724e2bdb602
Instruction Fuzzy Hash: 03F01D31442506ABD7515B94EF88BE67E25FF11702F402426F101D18A0C7789469EF90

Function 00565D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00565D30
GetWindowRect.USER32(?,?), ref: 00565D71
ScreenToClient.USER32(?,?), ref: 00565D99
GetClientRect.USER32(?,?), ref: 00565ED7
GetWindowRect.USER32(?,?), ref: 00565EF8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 5a1ee20e647a97833ed277211cbfdce697fefce87c2c567e1babecfa1ffce4fe
Instruction ID: a13c74e5cf7be544bfd5441a8ea8d78408ce81d569f74dd707a396d4b4bd7705
Opcode Fuzzy Hash: 5a1ee20e647a97833ed277211cbfdce697fefce87c2c567e1babecfa1ffce4fe
Instruction Fuzzy Hash: 47B16934A0064ADBDF10CFA8C4807EEBBF5FF58310F14881AE8A9D7250EB34AA51DB50

Function 005901B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005900BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005900D6
__allrem.LIBCMT ref: 005900ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0059010B
__allrem.LIBCMT ref: 00590122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00590140

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 9ac78968dd107dce0e9c893970a82c956538480845545445922a09fa18990b44
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 36811776A00B069FEB24AF68CC49B6B7BE8BF85724F24493AF511E72C1E770D9008750

Function 005E1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,005E101C,00000000,?,?,00000000), ref: 005E3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 005E1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 005E1DE1
WSAGetLastError.WSOCK32 ref: 005E1DF2
inet_ntoa.WSOCK32(?), ref: 005E1E8C
htons.WSOCK32(?,?,?,?,?), ref: 005E1EDB
_strlen.LIBCMT ref: 005E1F35

Part of subcall function 005C39E8: _strlen.LIBCMT ref: 005C39F2

Part of subcall function 00566D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0057CF58,?,?,?), ref: 00566DBA
Part of subcall function 00566D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0057CF58,?,?,?), ref: 00566DED

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 0c7603e023f278078abcebba576a3a7f37566a6f38d09acf0a19f895ecc1d2ff
Instruction ID: c2d68898662d02c108f35b0ff3a068fea7adf19ad70f48586c6ecbc4357aebae
Opcode Fuzzy Hash: 0c7603e023f278078abcebba576a3a7f37566a6f38d09acf0a19f895ecc1d2ff
Instruction Fuzzy Hash: 20A1D070104781AFC328DF21C889E2A7FA5BFD4318F54894CF4969B2A2DB31ED85CB91

Function 005961FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005882D9,005882D9,?,?,?,0059644F,00000001,00000001,8BE85006), ref: 00596258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0059644F,00000001,00000001,8BE85006,?,?,?), ref: 005962DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 005963D8
__freea.LIBCMT ref: 005963E5

Part of subcall function 00593820: RtlAllocateHeap.NTDLL(00000000,?,00631444,?,0057FDF5,?,?,0056A976,00000010,00631440,005613FC,?,005613C6,?,00561129), ref: 00593852

__freea.LIBCMT ref: 005963EE
__freea.LIBCMT ref: 00596413

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 681b9638c984ed1a76ea3f161eaa0fa928528ea9fc9562d2be1767765c45e121
Instruction ID: 2f5ad382b0bbb3b17748733250d78e364d85be081bea9c1343717dd5684afff2
Opcode Fuzzy Hash: 681b9638c984ed1a76ea3f161eaa0fa928528ea9fc9562d2be1767765c45e121
Instruction Fuzzy Hash: DE51D072600216ABEF268F64DC85EAF7FA9FB84750F154A29FC05D7180EB34DC58D660

Function 005EBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005EC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EB6AE,?,?), ref: 005EC9B5
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005EC9F1
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA68
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005EBD25
RegCloseKey.ADVAPI32(00000000), ref: 005EBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 005EBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 005EBDF3
RegCloseKey.ADVAPI32(?), ref: 005EBDFF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 1c55dbc4239f5799a2920a018f89e60cbb57f43b3dd91155ffb3f197bb528c76
Instruction ID: 3d6099a6c170ede39f28094953ddde5ab1769ada31693352f08c30bf456c1340
Opcode Fuzzy Hash: 1c55dbc4239f5799a2920a018f89e60cbb57f43b3dd91155ffb3f197bb528c76
Instruction Fuzzy Hash: 93816F30108241AFD714DF24C995E6ABFE9FF84308F14896CF5998B2A2DB31ED45CB92

Function 005BF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 005BF7B9
SysAllocString.OLEAUT32(00000001), ref: 005BF860
VariantCopy.OLEAUT32(005BFA64,00000000), ref: 005BF889
VariantClear.OLEAUT32(005BFA64), ref: 005BF8AD
VariantCopy.OLEAUT32(005BFA64,00000000), ref: 005BF8B1
VariantClear.OLEAUT32(?), ref: 005BF8BB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: e2ee10b6fe1378e1733ee39c97e01d685d1aa36bc5a14ec31a645e8c1e64dbd3
Instruction ID: 93fb0a88ed585935eaa2c1e76ff39ca1edac4ca5308ebe5314f56d289a3a6125
Opcode Fuzzy Hash: e2ee10b6fe1378e1733ee39c97e01d685d1aa36bc5a14ec31a645e8c1e64dbd3
Instruction Fuzzy Hash: 0451D531600311BACF20AB65DC99BA9BBA8FF95710F209877F905DF291DB70AC40D766

Function 005D910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00567620: _wcslen.LIBCMT ref: 00567625

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 005D94E5
_wcslen.LIBCMT ref: 005D9506
_wcslen.LIBCMT ref: 005D952D
GetSaveFileNameW.COMDLG32(00000058), ref: 005D9585

Strings

X, xrefs: 005D9412

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 2536a00314a18aa88483acd29726a26c9574a2b72b94323419c59216bfa5c2ec
Instruction ID: 1d12643e55bcda1e78b9c5c9c33a17b72c4a66e8e8ec9b56f9f7424bc6dd651f
Opcode Fuzzy Hash: 2536a00314a18aa88483acd29726a26c9574a2b72b94323419c59216bfa5c2ec
Instruction Fuzzy Hash: 26E184316043419FD724DF28C485A6ABBE4BFC5314F14896EF8899B3A2EB31DD45CB92

Function 0057920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

BeginPaint.USER32(?,?,?), ref: 00579241
GetWindowRect.USER32(?,?), ref: 005792A5
ScreenToClient.USER32(?,?), ref: 005792C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005792D3
EndPaint.USER32(?,?,?,?,?), ref: 00579321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 005B71EA

Part of subcall function 00579339: BeginPath.GDI32(00000000), ref: 00579357

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 7e5dac0af633540fa402ff3bd545758478b3719c87f0c0bd6cc3ca79c62d9dd0
Instruction ID: 1ca3cfc51087c9ce95ecbc531eb40363e2844be729207f4425530393051dfd22
Opcode Fuzzy Hash: 7e5dac0af633540fa402ff3bd545758478b3719c87f0c0bd6cc3ca79c62d9dd0
Instruction Fuzzy Hash: 0D41A070108205AFD710DF28D884FBA7FA9FB9A320F144669F959CB2E1C7319845EBB1

Function 005D07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 005D080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 005D0847
EnterCriticalSection.KERNEL32(?), ref: 005D0863
LeaveCriticalSection.KERNEL32(?), ref: 005D08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 005D08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 005D0921

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: b1859826ecb6d04400769156e00447fccc82e6760aa2d968b6e7e6862bb96091
Instruction ID: 0cc6d781c5c90b6fb7237638f5afab481ce47bdefae5191ac20a260964933525
Opcode Fuzzy Hash: b1859826ecb6d04400769156e00447fccc82e6760aa2d968b6e7e6862bb96091
Instruction Fuzzy Hash: 74415971900205ABDF14EF58DC89A6A7B79FF44310F1480A6ED04EA297D734DE65EBA0

Function 005F81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,005BF3AB,00000000,?,?,00000000,?,005B682C,00000004,00000000,00000000), ref: 005F824C
EnableWindow.USER32(?,00000000), ref: 005F8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 005F82D1
ShowWindow.USER32(?,00000004), ref: 005F82E5
EnableWindow.USER32(?,00000001), ref: 005F830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 005F832F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 23860e0c979abc8715235547f8166bdf76ebb6cbb53aa593c41497c014be6d5a
Instruction ID: 12029007898df74d3a54f4e95bfbfccf1e58c16c192b2a1f963113b26ca150df
Opcode Fuzzy Hash: 23860e0c979abc8715235547f8166bdf76ebb6cbb53aa593c41497c014be6d5a
Instruction Fuzzy Hash: 3C417134601A48EFDB11CF15CD99BF87FE1BB4A714F185569E6088F2B2CB35A845CB50

Function 005C4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 005C4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 005C4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 005C4CEA
_wcslen.LIBCMT ref: 005C4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 005C4D10
_wcsstr.LIBVCRUNTIME ref: 005C4D1A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 7234cb7915374b01b7d1358c1d8f79d796de98213e855579751a0bd88d4426f6
Instruction ID: 2cd87ebf8afb208648b5577006050b5841f8cb61dc080f69533a75a4854cdb80
Opcode Fuzzy Hash: 7234cb7915374b01b7d1358c1d8f79d796de98213e855579751a0bd88d4426f6
Instruction Fuzzy Hash: F121B6316041057FEB15AB69AD59F7B7F9CEF45750F10803DF809DE1A1EA659C00DB60

Function 005D581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00563A97,?,?,00562E7F,?,?,?,00000000), ref: 00563AC2

_wcslen.LIBCMT ref: 005D587B
CoInitialize.OLE32(00000000), ref: 005D5995
CoCreateInstance.OLE32(005FFCF8,00000000,00000001,005FFB68,?), ref: 005D59AE
CoUninitialize.OLE32 ref: 005D59CC

Strings

.lnk, xrefs: 005D5876, 005D58C1, 005D5985

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 4db1b2497d9bb2e8fd9eb3ac2735d40b92bd2e2018d3c7076f3d2d39ad35c099
Instruction ID: 08da4494df058f7170fa56926c453076f800a8f391b8bd7678b3d07d428b41bc
Opcode Fuzzy Hash: 4db1b2497d9bb2e8fd9eb3ac2735d40b92bd2e2018d3c7076f3d2d39ad35c099
Instruction Fuzzy Hash: 5CD155716087059FC724DF28C49492ABBE5FF89714F14485EF88A9B361EB31EC45CB92

Function 005C175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005C0FCA
Part of subcall function 005C0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005C0FD6
Part of subcall function 005C0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005C0FE5
Part of subcall function 005C0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005C0FEC
Part of subcall function 005C0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005C1002

GetLengthSid.ADVAPI32(?,00000000,005C1335), ref: 005C17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 005C17BA
HeapAlloc.KERNEL32(00000000), ref: 005C17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 005C17DA
GetProcessHeap.KERNEL32(00000000,00000000,005C1335), ref: 005C17EE
HeapFree.KERNEL32(00000000), ref: 005C17F5

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ac6fcc05869aa2ab342a6106236e28a8a01db7921eeca810db7ca5e5b3abbd68
Instruction ID: 00f221a67e4d161e4b2ce8795cc7bcc93ec9dce0926d13065176cca2f535d25b
Opcode Fuzzy Hash: ac6fcc05869aa2ab342a6106236e28a8a01db7921eeca810db7ca5e5b3abbd68
Instruction Fuzzy Hash: D1118931500609EFDB149BA4CD49FAE7FE9FF42355F10442CE481D7212C739A959DB68

Function 005C14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005C14FF
OpenProcessToken.ADVAPI32(00000000), ref: 005C1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 005C1515
CloseHandle.KERNEL32(00000004), ref: 005C1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005C154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 005C1563

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ba49a26f52a42f9ca4f9441bf86b08021e9cc67c64ff90976807e3ee60317cfe
Instruction ID: 07dde692ae4a36b43fa5fd9bbaed4add2955c223be7eab89680e90253e647329
Opcode Fuzzy Hash: ba49a26f52a42f9ca4f9441bf86b08021e9cc67c64ff90976807e3ee60317cfe
Instruction Fuzzy Hash: E011247250120DAFDF118F98DE49FAA7FA9FF49744F044068FA05A2160C3758E69EB64

Function 00583382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00583379,00582FE5), ref: 00583390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0058339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005833B7
SetLastError.KERNEL32(00000000,?,00583379,00582FE5), ref: 00583409

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c895582696e2f834c8b33eee9ca453dd84f55adcdd4ac42bcb20885fdca1254d
Instruction ID: 880d70a6233715866dc9970f608bdb5d88a588ffa45b375ddebe9f1cdf8d2b32
Opcode Fuzzy Hash: c895582696e2f834c8b33eee9ca453dd84f55adcdd4ac42bcb20885fdca1254d
Instruction Fuzzy Hash: DA012832208712BEEB2437797C9992B2E94FB55B757200629FC10A01F0EF124D069784

Function 00592D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00595686,005A3CD6,?,00000000,?,00595B6A,?,?,?,?,?,0058E6D1,?,00628A48), ref: 00592D78
_free.LIBCMT ref: 00592DAB
_free.LIBCMT ref: 00592DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0058E6D1,?,00628A48,00000010,00564F4A,?,?,00000000,005A3CD6), ref: 00592DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0058E6D1,?,00628A48,00000010,00564F4A,?,?,00000000,005A3CD6), ref: 00592DEC
_abort.LIBCMT ref: 00592DF2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 8e415d3056760e31350491b14027f584d66f8336d7dc75e7c0702c3ffb976f22
Instruction ID: e0c636096d6380daf236a54650a56dc7560d6caf80d5718fb7a4571ade110887
Opcode Fuzzy Hash: 8e415d3056760e31350491b14027f584d66f8336d7dc75e7c0702c3ffb976f22
Instruction Fuzzy Hash: F8F0A436545B0277CF226738AC0EE2F2D5ABFD17A1F250829F829D21D2EE24880751A0

Function 005F8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00579639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00579693
Part of subcall function 00579639: SelectObject.GDI32(?,00000000), ref: 005796A2
Part of subcall function 00579639: BeginPath.GDI32(?), ref: 005796B9
Part of subcall function 00579639: SelectObject.GDI32(?,00000000), ref: 005796E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 005F8A4E
LineTo.GDI32(?,00000003,00000000), ref: 005F8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 005F8A70
LineTo.GDI32(?,00000000,00000003), ref: 005F8A80
EndPath.GDI32(?), ref: 005F8A90
StrokePath.GDI32(?), ref: 005F8AA0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 0c9461bb6348ccbfadfc51f9382e73749283a79b64b29d352aa09c87c6178d54
Instruction ID: 2f7eb55cf70541f7beada5cad6c0fc5fcee60269915f0d66329236ceb0455a87
Opcode Fuzzy Hash: 0c9461bb6348ccbfadfc51f9382e73749283a79b64b29d352aa09c87c6178d54
Instruction Fuzzy Hash: 3C111B7600010DFFDF129F90DC88FAA7F6DEB09364F008062BA199A1A1CB759D55EFA0

Function 005C51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005C5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 005C5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 005C5230
ReleaseDC.USER32(00000000,00000000), ref: 005C5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 005C524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 005C5261

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d15534bef92d4d7dcdbdc26261e0fe9bd450effff7571d7e3bc22e5346262248
Instruction ID: b9a35ec18c24229b6d634b109bd2d326044a56d4f6a827dad70e784e992c17e3
Opcode Fuzzy Hash: d15534bef92d4d7dcdbdc26261e0fe9bd450effff7571d7e3bc22e5346262248
Instruction Fuzzy Hash: 5B018F75A40708BBEB109BE59D49F5EBFB8FB58351F044065FA04E7380DA709808DBA0

Function 00561BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00561BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00561BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00561C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00561C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00561C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00561C22

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c8b823cc951e05db1910d1d648860dd4c7177ea3b205abd97b8900e77faa9a51
Instruction ID: d2978add2c5cfa1977392ab3673b5259adda80062e3c70c986b9d16039215494
Opcode Fuzzy Hash: c8b823cc951e05db1910d1d648860dd4c7177ea3b205abd97b8900e77faa9a51
Instruction Fuzzy Hash: 9D016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C8B941C7F5A868CBE5

Function 005CEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005CEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 005CEB46
GetWindowThreadProcessId.USER32(?,?), ref: 005CEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CEB75

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: d925877aa33410dd7f7504cbae8379055ba5b5cdfc93574dd0ae4b10cd97dfdd
Instruction ID: e23e9447844fbc8787936d85e82be57cdd5fd922b2bcd4570b1150e4e6a65a8b
Opcode Fuzzy Hash: d925877aa33410dd7f7504cbae8379055ba5b5cdfc93574dd0ae4b10cd97dfdd
Instruction Fuzzy Hash: EAF09A7220011CBBE7205BA29D0EEFF3E7CEFDAB11F000168F601D5090DBA81A05E6B4

Function 005B7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 005B7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 005B7469
GetWindowDC.USER32(?), ref: 005B7475
GetPixel.GDI32(00000000,?,?), ref: 005B7484
ReleaseDC.USER32(?,00000000), ref: 005B7496
GetSysColor.USER32(00000005), ref: 005B74B0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: fc374acd50e6cc56de9cca601ea3eedd923d466e63bbe7cf1e0e5482b2180189
Instruction ID: 6d9612b830e779f20ba97b9ef09ba762a39ac4030e7c9f92e742c6cfc757dd79
Opcode Fuzzy Hash: fc374acd50e6cc56de9cca601ea3eedd923d466e63bbe7cf1e0e5482b2180189
Instruction Fuzzy Hash: 2D018B31404209EFEB105F64DD08BFA7FB6FB18312F2000A0F916E61A0CB352E55EB50

Function 005C1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 005C187F
UnloadUserProfile.USERENV(?,?), ref: 005C188B
CloseHandle.KERNEL32(?), ref: 005C1894
CloseHandle.KERNEL32(?), ref: 005C189C
GetProcessHeap.KERNEL32(00000000,?), ref: 005C18A5
HeapFree.KERNEL32(00000000), ref: 005C18AC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: ef964fd67aeac926d2abd82f2d5b4fc88063861001e81f0620b44b02534e3601
Instruction ID: e7992392e0ff39e31f420da513bc5b2a68039941853b6ff049e149b434cf250a
Opcode Fuzzy Hash: ef964fd67aeac926d2abd82f2d5b4fc88063861001e81f0620b44b02534e3601
Instruction Fuzzy Hash: 8EE0C236004109BBDA016BA1EE0CD1ABF29FF69B22B108A34F225C10B0CB369438FB50

Function 005CC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00567620: _wcslen.LIBCMT ref: 00567625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005CC6EE
_wcslen.LIBCMT ref: 005CC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005CC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 005CC7CA

Strings

0, xrefs: 005CC6AF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 26ff1284aab9d06a1423ad396693efd19eb1bfbe99c4b47625dab26d94ddf359
Instruction ID: d69d131301516461a3250db7411d4272c2f2b913338a57893c6c8ee7c93b09d0
Opcode Fuzzy Hash: 26ff1284aab9d06a1423ad396693efd19eb1bfbe99c4b47625dab26d94ddf359
Instruction Fuzzy Hash: EA51AC716143019FD710DEA8C989F6ABFE8FB89310F040A2DF999E71A0DB64D844DB92

Function 005EAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 005EAEA3

Part of subcall function 00567620: _wcslen.LIBCMT ref: 00567625

GetProcessId.KERNEL32(00000000), ref: 005EAF38
CloseHandle.KERNEL32(00000000), ref: 005EAF67

Strings

@, xrefs: 005EAE72
<, xrefs: 005EAE6B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 56d9151c9c435b7892a9aececb8bcb1cb49239112388e41e2c121921d7d233dc
Instruction ID: c3d052c47608a0014d57ad6f35c716db8c59c439ec301dc334699bfa12cff5d7
Opcode Fuzzy Hash: 56d9151c9c435b7892a9aececb8bcb1cb49239112388e41e2c121921d7d233dc
Instruction Fuzzy Hash: D0717874A0025ADFCB14DF65C488A9EBFF4BF48304F048499E856AB3A2DB74ED45CB91

Function 005C719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005C7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 005C723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 005C724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005C72CF

Strings

DllGetClassObject, xrefs: 005C7242

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4110b70bb59720509b7717da8a3f14372e9972d9b477db782b1dea505be7cb1f
Instruction ID: 173b4485a8942b63799525c23d5016ee944070cbe773f2b97cfa0a597e5b0c0e
Opcode Fuzzy Hash: 4110b70bb59720509b7717da8a3f14372e9972d9b477db782b1dea505be7cb1f
Instruction Fuzzy Hash: A1414C75604208AFDB15CF94C884FAA7FA9FF58310B2484ADBD059F60AD7B4DA44DFA0

Function 005F3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F3E35
IsMenu.USER32(?), ref: 005F3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005F3E92
DrawMenuBar.USER32 ref: 005F3EA5

Strings

0, xrefs: 005F3D89

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 638412e3920a4b77152931ba76eb09baa495b540f054a7bff40ce23d8df50b2d
Instruction ID: f1e4cdec929f567bb00cea1a5f229a79e784bd022aed6b0c3445cc2ea913d68c
Opcode Fuzzy Hash: 638412e3920a4b77152931ba76eb09baa495b540f054a7bff40ce23d8df50b2d
Instruction Fuzzy Hash: E0412775A0120DEFEF10DF50D884AEABBB9FF49354F044129EA15AB250D738AE45DF90

Function 005C1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005C3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 005C3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 005C1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 005C1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 005C1EA9

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

Strings

ComboBox, xrefs: 005C1DF0
ListBox, xrefs: 005C1E25

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 0e7730e255c7ac0473d7cc29e3a15546f26be59c1d521a10497f4521cc9b0d6b
Instruction ID: 046bd1e06ab285f8891df0a107392f135fe93806ac93c5de54c165d3bb31ff6c
Opcode Fuzzy Hash: 0e7730e255c7ac0473d7cc29e3a15546f26be59c1d521a10497f4521cc9b0d6b
Instruction Fuzzy Hash: FA210671A00109AEDB14ABA4DD49DFF7FADBF92350B10412DF815E71E1DB384D09D620

Function 005EC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005EC9F1
_wcslen.LIBCMT ref: 005ECA68
_wcslen.LIBCMT ref: 005ECA9E
_wcslen.LIBCMT ref: 005ECAF9
_wcslen.LIBCMT ref: 005ECB2F
_wcslen.LIBCMT ref: 005ECB7F

Strings

HKLM, xrefs: 005ECA98, 005ECA9D
HKEY_LOCAL_MACHINE, xrefs: 005ECA62, 005ECA67

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 32a0d5ec84068950b1d4b985ea76b0b280e80dd9e7c3399157fde640850f6226
Instruction ID: f5c6837e9531e74e31b67bd85da3beeed39c4d9572ab1033b52bb0aa22feee7c
Opcode Fuzzy Hash: 32a0d5ec84068950b1d4b985ea76b0b280e80dd9e7c3399157fde640850f6226
Instruction Fuzzy Hash: BE312B736005EA4BCB28EF2ED9404BE3F927BA1750B154039ECD56B244E670CD82D7A0

Function 005F2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 005F2F8D
LoadLibraryW.KERNEL32(?), ref: 005F2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 005F2FA9
DestroyWindow.USER32(?), ref: 005F2FB1

Strings

SysAnimate32, xrefs: 005F2F68

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: a0025ead0ab5581b4e97c042a45c61f92bf2701be7d46fa6be8370e151acb82c
Instruction ID: 568577ccc958feb8cb758661845f3af948407d20f10483ec23aa3fd3300d8410
Opcode Fuzzy Hash: a0025ead0ab5581b4e97c042a45c61f92bf2701be7d46fa6be8370e151acb82c
Instruction Fuzzy Hash: 1221F0B122420EABEB104F64DC86EBB3BBDFB59324F100628FA50D60A0D339DC41DB60

Function 00584D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00584D1E,005928E9,?,00584CBE,005928E9,006288B8,0000000C,00584E15,005928E9,00000002), ref: 00584D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00584DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00584D1E,005928E9,?,00584CBE,005928E9,006288B8,0000000C,00584E15,005928E9,00000002,00000000), ref: 00584DC3

Strings

CorExitProcess, xrefs: 00584D98
mscoree.dll, xrefs: 00584D86

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f9771debc6bc29ba201bcbbeac8d1e2c1c62b6467995899c7120c5cf513d7871
Instruction ID: de2dea4be0885dba5a104fff32bca6f0082100f6f5ee432d9af34b46c0985aa9
Opcode Fuzzy Hash: f9771debc6bc29ba201bcbbeac8d1e2c1c62b6467995899c7120c5cf513d7871
Instruction Fuzzy Hash: 3BF0AF30A4020DBBEB14AF90DC09BAEBFBAEF44751F0000A4FC05E62A0CB345944DF90

Function 00564E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00564EDD,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00564EAE
FreeLibrary.KERNEL32(00000000,?,?,00564EDD,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00564EA8
kernel32.dll, xrefs: 00564E94

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 982ad42df110126e3d5d052c13d86898099c6ab7d5760cc99ab24ccb28755463
Instruction ID: f72c35d9195a9aa7e2091c338b1343d240dc97dca74d8e9b72e087a60ffdf81e
Opcode Fuzzy Hash: 982ad42df110126e3d5d052c13d86898099c6ab7d5760cc99ab24ccb28755463
Instruction Fuzzy Hash: 43E08635A016365BD22117256D18E7B6D59BF91B627050125FD04E7200DB68CD09D8A1

Function 00564E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,005A3CDE,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00564E74
FreeLibrary.KERNEL32(00000000,?,?,005A3CDE,?,00631418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00564E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00564E6E
kernel32.dll, xrefs: 00564E5B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: f054fa08ff729caa02f68f7c2ff2dc011c70d733d1e0ecf503c8ad0ec31713b5
Instruction ID: be6713ccd2a8a4f01b9fec3580be4fe878b50b28c8623621ba2dc9817184e15d
Opcode Fuzzy Hash: f054fa08ff729caa02f68f7c2ff2dc011c70d733d1e0ecf503c8ad0ec31713b5
Instruction Fuzzy Hash: 18D02B39502A365B86321B247C0CDEF2E1DBF81F113050131F904E7210CF29CD15D9D1

Function 005D2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005D2C05
DeleteFileW.KERNEL32(?), ref: 005D2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005D2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005D2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005D2CC0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: d874cae5faf11f8762fba6c282c900ed1cef0467af16616a7ac0a9330670d188
Instruction ID: ed9ceb542e9c93fe5c4681706075997788d39914b53eff44b4cf39e5f49a839d
Opcode Fuzzy Hash: d874cae5faf11f8762fba6c282c900ed1cef0467af16616a7ac0a9330670d188
Instruction Fuzzy Hash: 7AB11E7190011AABDF21EBA4CC89EDE7B7DFF59350F1040A7F909E7251EA709E448B61

Function 005EA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 005EA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 005EA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 005EA468
CloseHandle.KERNEL32(?), ref: 005EA63D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 432834cd2a8f7b65546b7cd2173a28c008d377fca63ef7f1a292ad5f7a975fbc
Instruction ID: 482650063fff0c95cc84695ac5c91379110d56b3385c6d240b3302382b11abef
Opcode Fuzzy Hash: 432834cd2a8f7b65546b7cd2173a28c008d377fca63ef7f1a292ad5f7a975fbc
Instruction Fuzzy Hash: 78A19E716043019FD724DF24D88AB2ABBE1BF84714F14885DF59A9B3D2DBB0EC418B92

Function 005CE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005CCF22,?), ref: 005CDDFD

Part of subcall function 005CDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005CCF22,?), ref: 005CDE16

Part of subcall function 005CE199: GetFileAttributesW.KERNEL32(?,005CCF95), ref: 005CE19A

lstrcmpiW.KERNEL32(?,?), ref: 005CE473
MoveFileW.KERNEL32(?,?), ref: 005CE4AC
_wcslen.LIBCMT ref: 005CE5EB
_wcslen.LIBCMT ref: 005CE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 005CE650

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 52c926b9a996a28be65ba77ed7730117edb79aaf32f8ea466f741513b99f98ed
Instruction ID: 0abff8aa6b12760b4d0b75562f596e15175684263951fd3e9869214dd80bb118
Opcode Fuzzy Hash: 52c926b9a996a28be65ba77ed7730117edb79aaf32f8ea466f741513b99f98ed
Instruction Fuzzy Hash: C4515FB24087459FC724EB90D885EDB7BECBFD4340F00492EE689D3191EE75A5888766

Function 005EB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005EC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EB6AE,?,?), ref: 005EC9B5
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005EC9F1
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA68
Part of subcall function 005EC998: _wcslen.LIBCMT ref: 005ECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005EBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 005EBB63
RegCloseKey.ADVAPI32(?,?), ref: 005EBBA6
RegCloseKey.ADVAPI32(00000000), ref: 005EBBB3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 3c9a22792537bcdcdcf7eda90fade66d77bb91cd68af30e50a357bae15a7b12b
Instruction ID: 74dc1b121d1b764f5a36e9648e00c652ca832f93b3ff987e2b920b4695708fcd
Opcode Fuzzy Hash: 3c9a22792537bcdcdcf7eda90fade66d77bb91cd68af30e50a357bae15a7b12b
Instruction Fuzzy Hash: 68615E31108245AFE718DF15C494E6BBBE9FF84308F54896CF4998B2A2DB31ED45CB92

Function 005C8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005C8BCD
VariantClear.OLEAUT32 ref: 005C8C3E
VariantClear.OLEAUT32 ref: 005C8C9D
VariantClear.OLEAUT32(?), ref: 005C8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 005C8D3B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: fef1f384b384a3f5d1b2883c9849fbcebc4e389b17f9253ae326690f058dea78
Instruction ID: 35fb4b05f031ac042212c86eae6f10b41da437f63750d248843963fea0d12d22
Opcode Fuzzy Hash: fef1f384b384a3f5d1b2883c9849fbcebc4e389b17f9253ae326690f058dea78
Instruction Fuzzy Hash: D2515BB5A00219EFCB14CF58D894EAABBF8FF89310B158569E906DB350E734E911CB90

Function 005D8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 005D8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 005D8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 005D8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 005D8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 005D8C5F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 0e1e2ec2e379f04c9040699d32aaec67830ce672c54952fab65ca875a175ec5c
Instruction ID: 6c745372e3db4dfa5c535b21b5f53eeb43a9f38e67b91091552969e1867c7a3b
Opcode Fuzzy Hash: 0e1e2ec2e379f04c9040699d32aaec67830ce672c54952fab65ca875a175ec5c
Instruction Fuzzy Hash: A3515B35A00219DFCB14DF64C884A69BFF5FF48314F08849AE84AAB362DB35ED51DB90

Function 005E8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 005E8F40
GetProcAddress.KERNEL32(00000000,?), ref: 005E8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 005E8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 005E9032
FreeLibrary.KERNEL32(00000000), ref: 005E9052

Part of subcall function 0057F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,005D1043,?,753CE610), ref: 0057F6E6
Part of subcall function 0057F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,005BFA64,00000000,00000000,?,?,005D1043,?,753CE610,?,005BFA64), ref: 0057F70D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 8b913b93e43441335fed3f107e832ed89206d98b9483e8cf322845787bf2b372
Instruction ID: 2df6a833234de5ce8228d20bebb78443d942fff0e61980623d7c758c788d86b3
Opcode Fuzzy Hash: 8b913b93e43441335fed3f107e832ed89206d98b9483e8cf322845787bf2b372
Instruction Fuzzy Hash: CD512835600246DFC715DF59C4988ADBFF1FF99314B0480A9E85AAB362DB31ED85CB90

Function 005F6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 005F6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 005F6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 005F6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,005DAB79,00000000,00000000), ref: 005F6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 005F6CC7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 8c326dea3290f4140a48227355b638bbf39c9bea6ba8d12e4c69adeb539120d4
Instruction ID: 5d10ec28236ac0ac8dc68b7499f39fc1ed8821c6b27ba23befd8978dba6beb8d
Opcode Fuzzy Hash: 8c326dea3290f4140a48227355b638bbf39c9bea6ba8d12e4c69adeb539120d4
Instruction Fuzzy Hash: C341A13560410CAFD724DF28CD58FB97FA5FB0A350F150628EA95EB2E1C379AD41DA40

Function 0057912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00579141
ScreenToClient.USER32(00000000,?), ref: 0057915E
GetAsyncKeyState.USER32(00000001), ref: 00579183
GetAsyncKeyState.USER32(00000002), ref: 0057919D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 410e7ebd14c0571a3af6792175f0acebce873ea7ae911dd12ea0d060ebf07f2b
Instruction ID: 0a0515ec0187e7674d1fb35cda9fae88bc43f3a37652c8d7e358a733ff26b3b5
Opcode Fuzzy Hash: 410e7ebd14c0571a3af6792175f0acebce873ea7ae911dd12ea0d060ebf07f2b
Instruction Fuzzy Hash: 2041707190851BBBDF059F68D848BFEBF75FB49320F208229E429A7290C7346D54DBA1

Function 005D3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 005D38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 005D3922
TranslateMessage.USER32(?), ref: 005D394B
DispatchMessageW.USER32(?), ref: 005D3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005D3966

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: dd7d09a2b5bfe75633eca8a368541dc7587923c859753c3ee6bde1714830c168
Instruction ID: 2a28a26eac4516cde58186598a3b685f0a1161a9f534bfd7c034316b23461974
Opcode Fuzzy Hash: dd7d09a2b5bfe75633eca8a368541dc7587923c859753c3ee6bde1714830c168
Instruction Fuzzy Hash: 4F31B7705043469EEB35CF389868BB63FA8FB16304F04056FE462C62A0E3F49684DB53

Function 005DCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 005DCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 005DCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,005DC21E,00000000), ref: 005DCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,005DC21E,00000000), ref: 005DCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,005DC21E,00000000), ref: 005DCFF2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: a1e45f24d74449c97e1ae8efd9d63639d3b0dd7d848875ae1a77ada5986a2f28
Instruction ID: 2a2b06c4aa40fdb26a67049338fe182966f355e8c953494e91fc8afe7cff6fb8
Opcode Fuzzy Hash: a1e45f24d74449c97e1ae8efd9d63639d3b0dd7d848875ae1a77ada5986a2f28
Instruction Fuzzy Hash: B6314B7150420BAFDB30DFA9D984AAABFF9FB54355B10442FF506D2241DB34AE44DB60

Function 005C1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005C1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 005C19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 005C19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 005C19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 005C19E2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 53506142456f12c2c6a915af177d867e669031823c92cac2eb62983247903881
Instruction ID: 8835279425eba7877b7eba6dde4d130b3af7ad9ba68a0d22576fb1e3a1e697b2
Opcode Fuzzy Hash: 53506142456f12c2c6a915af177d867e669031823c92cac2eb62983247903881
Instruction Fuzzy Hash: F831AD71900219EFCB00CFA8C998BAE3FB5FB05314F104229F921EB2D1C7709954DB90

Function 005F5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 005F5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 005F579D
_wcslen.LIBCMT ref: 005F57AF
_wcslen.LIBCMT ref: 005F57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 005F5816

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: a7d4204a978d50276ee08217b0cc79d4d7d1728adb15f69b131500c8b346506e
Instruction ID: a9f0a00e7c3eb62c09242a264679fd01eeb4d60a36910eec574866bd432b9b3e
Opcode Fuzzy Hash: a7d4204a978d50276ee08217b0cc79d4d7d1728adb15f69b131500c8b346506e
Instruction Fuzzy Hash: AE21A53190461C9ADF209F64CC88AFD7FB9FF54320F108616EB19EA180E7788985CF50

Function 005E0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 005E0951
GetForegroundWindow.USER32 ref: 005E0968
GetDC.USER32(00000000), ref: 005E09A4
GetPixel.GDI32(00000000,?,00000003), ref: 005E09B0
ReleaseDC.USER32(00000000,00000003), ref: 005E09E8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 92a97f7679a1bf04ca055c5a31841e0519ea73a1dd8f47c6081251723183cd23
Instruction ID: a28f9828c6b51c38274d02fa109149abccd1154cea7407151e4232098c171489
Opcode Fuzzy Hash: 92a97f7679a1bf04ca055c5a31841e0519ea73a1dd8f47c6081251723183cd23
Instruction Fuzzy Hash: 05216F35600204AFD714EF69D989AAEBFE9FF94700F048479E84AD7362DB74AC44DB50

Function 0059CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0059CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0059CDE9

Part of subcall function 00593820: RtlAllocateHeap.NTDLL(00000000,?,00631444,?,0057FDF5,?,?,0056A976,00000010,00631440,005613FC,?,005613C6,?,00561129), ref: 00593852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0059CE0F
_free.LIBCMT ref: 0059CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0059CE31

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 36e8cb0fde9a505403f13816496541a3e6d88c07df1c3eba52f2856b3de275f1
Instruction ID: 5cc9fa09606fdda1cd40ff1e3c633fa95bdb7f1342b2a0d1afb499ce4a711182
Opcode Fuzzy Hash: 36e8cb0fde9a505403f13816496541a3e6d88c07df1c3eba52f2856b3de275f1
Instruction Fuzzy Hash: 3001A7726022157F2B2256B66D8CD7B7D6DFEC6BA13150129FD07C7241EA658D01D2F0

Function 00579639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00579693
SelectObject.GDI32(?,00000000), ref: 005796A2
BeginPath.GDI32(?), ref: 005796B9
SelectObject.GDI32(?,00000000), ref: 005796E2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: fdca7bc723b8376b7bebdedf149f6a1a0861edb6ceb1c0a476dbf12cebc5a003
Instruction ID: 69e2f76c23a87ac6ccb6394fac1f2d4d6a29d30ba1c5a1c63ad5e96c1b10c5b6
Opcode Fuzzy Hash: fdca7bc723b8376b7bebdedf149f6a1a0861edb6ceb1c0a476dbf12cebc5a003
Instruction Fuzzy Hash: 07218330801309EBDB119F64ED08BB93FAABB52725F104316F4149A1F0D3749855EBE4

Function 005C5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 005C5726
_memcmp.LIBVCRUNTIME ref: 005C5744
_memcmp.LIBVCRUNTIME ref: 005C5757
_memcmp.LIBVCRUNTIME ref: 005C576F
_memcmp.LIBVCRUNTIME ref: 005C5787

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a00cbf89aa5d17c4c716db69be5527d2b35a057f5d1418ae7c9895dd569dd9f6
Instruction ID: 6b8899259dd2d856b687645e5f573952ddd9fcbf1f0e0991646aab4b9743bf6a
Opcode Fuzzy Hash: a00cbf89aa5d17c4c716db69be5527d2b35a057f5d1418ae7c9895dd569dd9f6
Instruction Fuzzy Hash: 7201D661241A09BFD20862909D42FBA7F9DFF613D4B000428FE05AA641FA20FD9183E8

Function 00592DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0058F2DE,00593863,00631444,?,0057FDF5,?,?,0056A976,00000010,00631440,005613FC,?,005613C6), ref: 00592DFD
_free.LIBCMT ref: 00592E32
_free.LIBCMT ref: 00592E59
SetLastError.KERNEL32(00000000,00561129), ref: 00592E66
SetLastError.KERNEL32(00000000,00561129), ref: 00592E6F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: d18f8674181877d5312272667fbe73e51fea05d9b92b4ebc1d89d6e9e733fff4
Instruction ID: ba5f232f70c4eeb257484b69c0c9f522f9d8c6991c1eeb8632bfcba5de62a475
Opcode Fuzzy Hash: d18f8674181877d5312272667fbe73e51fea05d9b92b4ebc1d89d6e9e733fff4
Instruction Fuzzy Hash: 3601F436645A017BCF1267386CCED3B2E9EBFE13B5F254828F425E21D2EB648C055160

Function 005C000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?,?,005C035E), ref: 005C002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?), ref: 005C0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?), ref: 005C0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?), ref: 005C0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005BFF41,80070057,?,?), ref: 005C0070

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: a382bf23e2759332042ac8a8e71b0b8a291590639443415f69c7fcdf96b8c05c
Instruction ID: ffbd4bfd1ae0326a286ea5b55ca4abc658091987b66cccdb764a4d6331ec134c
Opcode Fuzzy Hash: a382bf23e2759332042ac8a8e71b0b8a291590639443415f69c7fcdf96b8c05c
Instruction Fuzzy Hash: 2D017872600208EFDB104FA9DD08FBA7EBDFB44792F155128F905E2250E779DD44ABA0

Function 005C10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 005C1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005C0B9B,?,?,?), ref: 005C1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 005C114D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 317206bb9cb43731163c47afcaeadaf21dd6deb4b2e28e82e55e75d0d3548d9b
Instruction ID: 62e8f0af650ee24e9dc0c5a6b5cc209166abfcf303572ae1facf059812bed08f
Opcode Fuzzy Hash: 317206bb9cb43731163c47afcaeadaf21dd6deb4b2e28e82e55e75d0d3548d9b
Instruction Fuzzy Hash: 2E018C75200609BFDB115FA4DD49E6A3F6EFF8A3A0B240428FA41C3360DB35DC10EA60

Function 005C0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005C0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005C0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005C0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005C0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005C1002

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a11d78d281b3df78b4a811d70ba54a2cc28beeaba7f5bfe3a1847abe1982e0f0
Instruction ID: 7efc44468b06600826aa862486a7d6f3ff44fdd2885ca0fd206a465bf51a6270
Opcode Fuzzy Hash: a11d78d281b3df78b4a811d70ba54a2cc28beeaba7f5bfe3a1847abe1982e0f0
Instruction Fuzzy Hash: 4AF0A935200309AFDB210FA59D4EF6A3FADFF9A762F100829FA05D6291DA34DC50DA60

Function 005C1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005C102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005C1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005C1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005C104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005C1062

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d0a647cbd7a0b246289c5a7b953f28d60645ade2d4af8df6292ed9241fcf4287
Instruction ID: 042481285f7fcfb220507f5a5aa438f909cde3ef75403a21abd4243a9e89a17e
Opcode Fuzzy Hash: d0a647cbd7a0b246289c5a7b953f28d60645ade2d4af8df6292ed9241fcf4287
Instruction Fuzzy Hash: 9BF0A935240309AFDB211FA6ED4DF6A3FADFF9A761F100828FA05D6291CA34D850DA60

Function 005D030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,005D017D,?,005D32FC,?,00000001,005A2592,?), ref: 005D0324
CloseHandle.KERNEL32(?,?,?,?,005D017D,?,005D32FC,?,00000001,005A2592,?), ref: 005D0331
CloseHandle.KERNEL32(?,?,?,?,005D017D,?,005D32FC,?,00000001,005A2592,?), ref: 005D033E
CloseHandle.KERNEL32(?,?,?,?,005D017D,?,005D32FC,?,00000001,005A2592,?), ref: 005D034B
CloseHandle.KERNEL32(?,?,?,?,005D017D,?,005D32FC,?,00000001,005A2592,?), ref: 005D0358
CloseHandle.KERNEL32(?,?,?,?,005D017D,?,005D32FC,?,00000001,005A2592,?), ref: 005D0365

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8a2bc6634678ed87a81d942026115fc674446acbf7877e0428e1ac1193fda76f
Instruction ID: e529d63ff6e97a297cf66f4671bd209006bc2d5a5a7c499738736f2cadb5adef
Opcode Fuzzy Hash: 8a2bc6634678ed87a81d942026115fc674446acbf7877e0428e1ac1193fda76f
Instruction Fuzzy Hash: 8201AE72800B559FCB30AF6AD880916FBF9BF603153159E3FD19652A71C3B1A958DF80

Function 0059D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0059D752

Part of subcall function 005929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000), ref: 005929DE
Part of subcall function 005929C8: GetLastError.KERNEL32(00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000,00000000), ref: 005929F0

_free.LIBCMT ref: 0059D764
_free.LIBCMT ref: 0059D776
_free.LIBCMT ref: 0059D788
_free.LIBCMT ref: 0059D79A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8fbb526e14dbaac25403e1e3889acb459baffda9a615f4dda2ef5e8d587f42f5
Instruction ID: f591707c233e17dfff378a7ac55885f4b8bd576c69cff00e53381c0dda5809ff
Opcode Fuzzy Hash: 8fbb526e14dbaac25403e1e3889acb459baffda9a615f4dda2ef5e8d587f42f5
Instruction Fuzzy Hash: 89F0FF32544605ABCA21EBA4F9C5D1A7FEEFB44720BA41805F44CE7501C724FCC086B4

Function 005C5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 005C5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 005C5C6F
MessageBeep.USER32(00000000), ref: 005C5C87
KillTimer.USER32(?,0000040A), ref: 005C5CA3
EndDialog.USER32(?,00000001), ref: 005C5CBD

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 75ae50dc2a3d5d4af124ca8807c728b4d916dacda1d01d701ec990d0cf5a80cd
Instruction ID: a539d6acf8bf040b388e3b3317c0aafcfe28d5d723b35935d69988b031ec5839
Opcode Fuzzy Hash: 75ae50dc2a3d5d4af124ca8807c728b4d916dacda1d01d701ec990d0cf5a80cd
Instruction Fuzzy Hash: 7D0167305007049FEB205B94DE4EFA57FB8BB10B05F00056DA553E10E1EBF47D88DA50

Function 005922A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005922BE

Part of subcall function 005929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000), ref: 005929DE
Part of subcall function 005929C8: GetLastError.KERNEL32(00000000,?,0059D7D1,00000000,00000000,00000000,00000000,?,0059D7F8,00000000,00000007,00000000,?,0059DBF5,00000000,00000000), ref: 005929F0

_free.LIBCMT ref: 005922D0
_free.LIBCMT ref: 005922E3
_free.LIBCMT ref: 005922F4
_free.LIBCMT ref: 00592305

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 401377ad06a5286d294272d1df4ef9cea0852fff6ac0f4c377ce2ac6642e66bc
Instruction ID: 406f5623c54d9ff21c34fc3be214f7b423b95789e77b72a0ccb8e9c733d82065
Opcode Fuzzy Hash: 401377ad06a5286d294272d1df4ef9cea0852fff6ac0f4c377ce2ac6642e66bc
Instruction Fuzzy Hash: F8F03A74800921ABCF22EF64BC0580D3FA7B719760B00350AF818D72B1C7340A92EFE4

Function 005795C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 005795D4
StrokeAndFillPath.GDI32(?,?,005B71F7,00000000,?,?,?), ref: 005795F0
SelectObject.GDI32(?,00000000), ref: 00579603
DeleteObject.GDI32 ref: 00579616
StrokePath.GDI32(?), ref: 00579631

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 7f8cf4d2b0074f9868c5efb2f6d904e77cf08d718c1331a6d91d29ac26a0f373
Instruction ID: bd12a6d7c7f2899a0c56aaf233a570b53b84b3fe7ee4bd5e9e97cd069422789c
Opcode Fuzzy Hash: 7f8cf4d2b0074f9868c5efb2f6d904e77cf08d718c1331a6d91d29ac26a0f373
Instruction Fuzzy Hash: 11F0CD3500560CDBD7165F55ED1CB683F66BB12332F049324F459990F0CB348555EFA0

Function 00590F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 005910F9
__freea.LIBCMT ref: 00591117

Part of subcall function 00591537: _free.LIBCMT ref: 0059154F

Strings

am/pm, xrefs: 0059117A
a/p, xrefs: 005911DE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 547e34e6723fdd4bc043a54eab00da18e5ad8099b79d705d058ea83654d9edcb
Instruction ID: 218d4d3e57215d0d1308f47ce0d09df7b75e1335e483930374b417bfad7d0fb6
Opcode Fuzzy Hash: 547e34e6723fdd4bc043a54eab00da18e5ad8099b79d705d058ea83654d9edcb
Instruction Fuzzy Hash: 74D1E235A00A27DBDF299F68C8497BEBFB5FF05300F280959E9059B650D3359D80CB99

Function 005E61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00580242: EnterCriticalSection.KERNEL32(0063070C,00631884,?,?,0057198B,00632518,?,?,?,005612F9,00000000), ref: 0058024D
Part of subcall function 00580242: LeaveCriticalSection.KERNEL32(0063070C,?,0057198B,00632518,?,?,?,005612F9,00000000), ref: 0058028A

Part of subcall function 005800A3: __onexit.LIBCMT ref: 005800A9

__Init_thread_footer.LIBCMT ref: 005E6238

Part of subcall function 005801F8: EnterCriticalSection.KERNEL32(0063070C,?,?,00578747,00632514), ref: 00580202
Part of subcall function 005801F8: LeaveCriticalSection.KERNEL32(0063070C,?,00578747,00632514), ref: 00580235

Part of subcall function 005D359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005D35E4
Part of subcall function 005D359C: LoadStringW.USER32(00632390,?,00000FFF,?), ref: 005D360A

Strings

x#c, xrefs: 005E6353
x#c, xrefs: 005E636F
x#c, xrefs: 005E633A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#c$x#c$x#c
API String ID: 1072379062-206817551
Opcode ID: 947193d60c5e571066704b669c483dd050773f2cd4f3446ff053397e4b417412
Instruction ID: ef3945cfeac4d65f8c7fcb7ad67555f27bef7b3aa0e93f7ea2a08a8af3397c38
Opcode Fuzzy Hash: 947193d60c5e571066704b669c483dd050773f2cd4f3446ff053397e4b417412
Instruction Fuzzy Hash: 65C1D571A002469FCB18DF59C895DBEBBB9FF58380F10845AF945A7291D770ED44CB90

Function 00595AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOV, xrefs: 00595BA8, 00595C6C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: JOV
API String ID: 0-2007332367
Opcode ID: 059accd76d8384798f906a994c78eefcd157aed41164099d1e60c0e3943d4c33
Instruction ID: 41ef1f8c03cd8a66136ec65ef2af7dee9c64a09b68a0378802fde69364d43b83
Opcode Fuzzy Hash: 059accd76d8384798f906a994c78eefcd157aed41164099d1e60c0e3943d4c33
Instruction Fuzzy Hash: 7951A175D0060AAFDF22AFA4C849EAE7FB9BF49310F140459F806A7291E7359D21CB61

Function 00598A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00598B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00598B7A
__dosmaperr.LIBCMT ref: 00598B81

Strings

.X, xrefs: 00598A63

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .X
API String ID: 2434981716-3424028424
Opcode ID: 2e6589dfd39f489bb088e3b4e10970407e902bc718e36585358756b16244343f
Instruction ID: cc2e2f28f87f937c5ce1b9564029a8803684ab0844e3d05b06bfe8e5f0708482
Opcode Fuzzy Hash: 2e6589dfd39f489bb088e3b4e10970407e902bc718e36585358756b16244343f
Instruction Fuzzy Hash: 014146B0604045AFDF249F28CC94A7D7FA7FB87314F2C85A9E88587642DE318C02D790

Function 005C2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005CB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005C21D0,?,?,00000034,00000800,?,00000034), ref: 005CB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 005C2760

Part of subcall function 005CB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005C21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 005CB3F8

Part of subcall function 005CB32A: GetWindowThreadProcessId.USER32(?,?), ref: 005CB355
Part of subcall function 005CB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,005C2194,00000034,?,?,00001004,00000000,00000000), ref: 005CB365
Part of subcall function 005CB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,005C2194,00000034,?,?,00001004,00000000,00000000), ref: 005CB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005C27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005C281A

Strings

@, xrefs: 005C2832

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 70b0c169ed459d6a7903e63cb45c2ceff1aa387547232fe9992a45750ed6c222
Instruction ID: c2ce993df6cbbd68b4c1b5302649596d8830cde9114bc73867d370d5af64d679
Opcode Fuzzy Hash: 70b0c169ed459d6a7903e63cb45c2ceff1aa387547232fe9992a45750ed6c222
Instruction Fuzzy Hash: 9D412976900219AEDB10DBA4C986FEEBBB8FB49700F104099EA55B7181DA706E45CBA1

Function 0059172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00591769
_free.LIBCMT ref: 00591834
_free.LIBCMT ref: 0059183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00591760, 00591767, 00591796, 005917CE

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: b587cfd327e76acc756f2415b3b6a7b7e651df02868ff67be0fba06d79b664d1
Instruction ID: b2659c93493767457da072f6f60245ae28d0f2316b9d75d36e466ab1673a2f6d
Opcode Fuzzy Hash: b587cfd327e76acc756f2415b3b6a7b7e651df02868ff67be0fba06d79b664d1
Instruction Fuzzy Hash: F9316F75A0062AABDF21DB999885DAEBFFCFB85350F144166F80497211D6708A80DBA4

Function 005CC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 005CC306
DeleteMenu.USER32(?,00000007,00000000), ref: 005CC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00631990,00E65DA8), ref: 005CC395

Strings

0, xrefs: 005CC2DF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 3a4e16f874887a7ed8d6f2ba4e61e645e51069313540705fc4396c33ca66846e
Instruction ID: d0e217ae763cd18ed67a9790799f9e76099fa6e0dbaf67384a71fc39e300f348
Opcode Fuzzy Hash: 3a4e16f874887a7ed8d6f2ba4e61e645e51069313540705fc4396c33ca66846e
Instruction Fuzzy Hash: 75419F712043429FD720DF64E845F2ABFE8BBC5710F108A1DF9A9D7291D730A904CB52

Function 005F4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,005FCC08,00000000,?,?,?,?), ref: 005F44AA
GetWindowLongW.USER32 ref: 005F44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005F44D7

Strings

SysTreeView32, xrefs: 005F447C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 0a9f2a9b29a33c6988dceb53e898587059de29d7edc609006dfcde398889a40e
Instruction ID: 0b4aa78bf68b4e301b361e4769beb6b5709147fc55092b662a3cf6ad21c545e5
Opcode Fuzzy Hash: 0a9f2a9b29a33c6988dceb53e898587059de29d7edc609006dfcde398889a40e
Instruction Fuzzy Hash: CC316D3111460AABDF109E38DC49BEB7BA9FB48324F204725FA75A31D0D778AC549B50

Function 005C6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 005C6EED
VariantCopyInd.OLEAUT32(?,?), ref: 005C6F08
VariantClear.OLEAUT32(?), ref: 005C6F12

Strings

*j\, xrefs: 005C6E8B, 005C6E90, 005C6EF8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j\
API String ID: 2173805711-928285910
Opcode ID: c8af48d934e93f6e6f6c69d143c1cd3a45824d85d9deffa3ccbb4b0dbe5a3cda
Instruction ID: b802b581a4de0dd54ba8929621624d4a39e63a8ebaf54f2e015af710db5d25a8
Opcode Fuzzy Hash: c8af48d934e93f6e6f6c69d143c1cd3a45824d85d9deffa3ccbb4b0dbe5a3cda
Instruction Fuzzy Hash: 9B31B371604206DFCB05AFA4E854EBD7F75FF8A300B1008ACFA028B2A1D7749A95DB90

Function 005E304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 005E335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,005E3077,?,?), ref: 005E3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 005E307A
_wcslen.LIBCMT ref: 005E309B
htons.WSOCK32(00000000,?,?,00000000), ref: 005E3106

Strings

255.255.255.255, xrefs: 005E3095, 005E309A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 9adae16bdbdb3d9373b82d9c1515aeb58aa96863110ae5e3b5e80438d835196e
Instruction ID: 369b2fb629abfbdd3542ae7dc21bd1dd20821da58f6a785594b234c323d5e79b
Opcode Fuzzy Hash: 9adae16bdbdb3d9373b82d9c1515aeb58aa96863110ae5e3b5e80438d835196e
Instruction Fuzzy Hash: C531E4352002859FCB28CF2AC58DEA97FE0FF54314F248059E8558B3A2C732DE45C760

Function 005F3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 005F3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 005F3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 005F3F78

Strings

SysMonthCal32, xrefs: 005F3F0B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 639cbb5f5ff915069098139d73a7b47c2bf530837803d675eab4e76bf3fbc0b2
Instruction ID: 59bb20efebfcff2503794b24a76027b7c1a595ca29f5c528cb6676ec9cacf7db
Opcode Fuzzy Hash: 639cbb5f5ff915069098139d73a7b47c2bf530837803d675eab4e76bf3fbc0b2
Instruction Fuzzy Hash: F1218D32600219BBEF118E54DC46FEA3F7AFF88724F110214FA15AB190D6B9A954DB90

Function 005F4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 005F4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 005F4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 005F471A

Strings

msctls_updown32, xrefs: 005F4684

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 468a8a9d26ed55c3cfde77668fb2e273becbd32cb9f9648cb3f5ba3a4fc34eae
Instruction ID: bdd32fe4179700c5c8158b7b78596f278e9951f167c29bbe7790f329bef3702f
Opcode Fuzzy Hash: 468a8a9d26ed55c3cfde77668fb2e273becbd32cb9f9648cb3f5ba3a4fc34eae
Instruction Fuzzy Hash: 912151B5601209AFDB10DF68DC85DB73BADFB9A354B040059FA01DB291C734EC12CE60

Function 005C95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005C961D

Strings

#OnAutoItStartRegister, xrefs: 005C95F3
#requireadmin, xrefs: 005C95D9
#notrayicon, xrefs: 005C95B7

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: fd319f8bc622a32db65b41efd8c7ddc51efa170a19a6f4ecf9ab41917e84b8c0
Instruction ID: 352d159de1244519af758680e4b14d015f13119738c5504b028a3697ac78fe5c
Opcode Fuzzy Hash: fd319f8bc622a32db65b41efd8c7ddc51efa170a19a6f4ecf9ab41917e84b8c0
Instruction Fuzzy Hash: B92126322041126AD331AB64D80EFB77F98FF95314F50442EF94997081EB659D81C395

Function 005F37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 005F3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 005F3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 005F3876

Strings

Listbox, xrefs: 005F380F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: cd612b624cea200999ae793a011d7694dae97f8cece09e5d4f02aff8e63f289f
Instruction ID: b0f44d1fad524bcc1923ecaa1aa5e2a28d521ed6cf54acbe1c9bff288ebec802
Opcode Fuzzy Hash: cd612b624cea200999ae793a011d7694dae97f8cece09e5d4f02aff8e63f289f
Instruction Fuzzy Hash: A0218072611118BBEB119F54DC45EBB3B6AFF897A0F118124FA049B190C679DD52C7A0

Function 005D49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 005D4A5C
SetErrorMode.KERNEL32(00000000,?,?,005FCC08), ref: 005D4AD0

Strings

%lu, xrefs: 005D4A6F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 4ad9681ed7f4f60b9724487b971d3799eee4c1cb8c683c9530a22374443464aa
Instruction ID: 5253c8bb7bcdd2bad6314bf47fe5fde0cd5faa151c286ce17166c2c274f43fba
Opcode Fuzzy Hash: 4ad9681ed7f4f60b9724487b971d3799eee4c1cb8c683c9530a22374443464aa
Instruction Fuzzy Hash: 76317C74A00209AFDB10DF58C985EAA7BF8FF48308F1480A9E809DB352D771ED45CB61

Function 005F41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 005F424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 005F4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 005F4271

Strings

msctls_trackbar32, xrefs: 005F4226

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3a88d8c0f71ca20418c9bb1b5930d39473a80c397fb2d9ecbe6281d6ba7fe467
Instruction ID: d79c72d22c192dfb0aa2e9d6960554713c75e65c29de4b6660207c220f91fb7c
Opcode Fuzzy Hash: 3a88d8c0f71ca20418c9bb1b5930d39473a80c397fb2d9ecbe6281d6ba7fe467
Instruction Fuzzy Hash: 6D11E031240248BEEF205E28CC06FBB3FADFF95B64F010524FA55E60A0D275D811DB20

Function 005C2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

Part of subcall function 005C2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C2DC5
Part of subcall function 005C2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 005C2DD6
Part of subcall function 005C2DA7: GetCurrentThreadId.KERNEL32 ref: 005C2DDD
Part of subcall function 005C2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 005C2DE4

GetFocus.USER32 ref: 005C2F78

Part of subcall function 005C2DEE: GetParent.USER32(00000000), ref: 005C2DF9

GetClassNameW.USER32(?,?,00000100), ref: 005C2FC3
EnumChildWindows.USER32(?,005C303B), ref: 005C2FEB

Strings

%s%d, xrefs: 005C2FFF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: b88ec6a6ebd6d9ca3807ab2e5ef5b6cbe8d6d40dcd0a047113e3ce975505432a
Instruction ID: 15640d6fd29c253543a21cea5051964644f28ea253efc2fcd2ccd794044c6762
Opcode Fuzzy Hash: b88ec6a6ebd6d9ca3807ab2e5ef5b6cbe8d6d40dcd0a047113e3ce975505432a
Instruction Fuzzy Hash: AD11667160020A9BCF54AFA4DC89FED3F6ABFD4304F048079B909D7192DE7559499B60

Function 005F5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 005F58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 005F58EE
DrawMenuBar.USER32(?), ref: 005F58FD

Strings

0, xrefs: 005F588F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 1d2b79d44cbc8c9a3b4269b3da9d6ee28649584a116634e9969df5504abf9ea9
Instruction ID: 9dc7caf17de9cd591428b5687a57385466622b1dfb847712defb5964f99fe80c
Opcode Fuzzy Hash: 1d2b79d44cbc8c9a3b4269b3da9d6ee28649584a116634e9969df5504abf9ea9
Instruction Fuzzy Hash: 00013C3150021CEEDB619F11D848BAABFB9BF45360F1080A9EA49D6151EB748A84EF21

Function 005BD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 005BD3BF
FreeLibrary.KERNEL32 ref: 005BD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 005BD3B9
X64, xrefs: 005BD2A8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 4586307f1793367862545cbc70c586ea334b55796929085f69851fe0558e44e1
Instruction ID: 36d1ded3181460570edb07cfef86614253af6aeb7a4fb182e09756b0bd281ef9
Opcode Fuzzy Hash: 4586307f1793367862545cbc70c586ea334b55796929085f69851fe0558e44e1
Instruction Fuzzy Hash: C8F05C2550162987D73143104C24DFD7F707F10701B998C35E405E5105F718DC44D6B1

Function 005C007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f24adf4466fd5423c73933c5e7c8e3fe68c4f5cb6dcfc5479c048fa5de8f36
Instruction ID: 7f25360ca3fc46df0b1485922626ef435b04d4780f9c181e7f5804347b926d4d
Opcode Fuzzy Hash: 92f24adf4466fd5423c73933c5e7c8e3fe68c4f5cb6dcfc5479c048fa5de8f36
Instruction Fuzzy Hash: E4C13775A0021AEFCB04CFA4C898FAEBBB5FF48714F249598E505AB291D731ED41DB90

Function 005E342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005E3459
CoUninitialize.OLE32 ref: 005E3463
VariantInit.OLEAUT32(?), ref: 005E346E
VariantClear.OLEAUT32(?), ref: 005E371B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: e633a37ebd098a9f13670cc0ea78085ee61838ce3ce464f58fd0aad03f0c6f0e
Instruction ID: 8c9baa06f4e13de9fa918c02466518bd99da159aaa167ad33812eff37c56a3bb
Opcode Fuzzy Hash: e633a37ebd098a9f13670cc0ea78085ee61838ce3ce464f58fd0aad03f0c6f0e
Instruction Fuzzy Hash: 14A14D756043059FC714DF29C589A2ABBE5FF8C714F04885AF98A9B362DB30EE05CB51

Function 005C0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,005FFC08,?), ref: 005C05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,005FFC08,?), ref: 005C0608
CLSIDFromProgID.OLE32(?,?,00000000,005FCC40,000000FF,?,00000000,00000800,00000000,?,005FFC08,?), ref: 005C062D
_memcmp.LIBVCRUNTIME ref: 005C064E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 5dd1545a0045658bdf9df651650e5bf320829e51d972671c3b8ac2683f9fafc4
Instruction ID: 8c17b58f4444fc05f7573390da90bae2b4fe68a8ccb2b865ffb79040f79d0c96
Opcode Fuzzy Hash: 5dd1545a0045658bdf9df651650e5bf320829e51d972671c3b8ac2683f9fafc4
Instruction Fuzzy Hash: F381E975A00109EFCB04DFD4C984EEEBBB9FF89315F205558E506AB290DB71AE46CB60

Function 005A1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005A14C0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c396b836247baea0f360bbb50356314f9e8aa1a5b0b0069a6e7ccd9a22e86430
Instruction ID: 29f82041330a1518a8cd57bce5f9e22ef90406689d0ee5d8a8b5d9e03654baac
Opcode Fuzzy Hash: c396b836247baea0f360bbb50356314f9e8aa1a5b0b0069a6e7ccd9a22e86430
Instruction Fuzzy Hash: 19413B35A00A16ABDF217BBD8C4AABE3EA4FF8F370F140625F819D6192F634484157A5

Function 005F6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005F62E2
ScreenToClient.USER32(?,?), ref: 005F6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 005F6382

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: bf89316d3c233ae9275d7c5c0862d2612bb6d9d1f5fe0aef232b597a3555be77
Instruction ID: c979cc920ffa4fb7254dcc60782f8e7ca4a87598e8f4587222169b2958e451e5
Opcode Fuzzy Hash: bf89316d3c233ae9275d7c5c0862d2612bb6d9d1f5fe0aef232b597a3555be77
Instruction Fuzzy Hash: D7512974A00209EFCB14DF68D980ABE7BB6FB55360F108569FA159B2A0D734ED41CB90

Function 005E1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 005E1AFD
WSAGetLastError.WSOCK32 ref: 005E1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 005E1B8A
WSAGetLastError.WSOCK32 ref: 005E1B94

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: ffffb4d96fbe497cdaba1c0855fc6645c71f1630b4868018c0b658e0e484a0c1
Instruction ID: 8c7a97773ca86da0318f7687602c353b75b387bcf2a4762f57c7e17dba7b9f51
Opcode Fuzzy Hash: ffffb4d96fbe497cdaba1c0855fc6645c71f1630b4868018c0b658e0e484a0c1
Instruction Fuzzy Hash: 4F41B274600601AFE724AF24C88AF267BE5BB84718F54C458F95A9F3D2D772ED41CB90

Function 0059B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b7be04bcb964f0c48824656df875d837866927ce70080593b1f37732907fbd
Instruction ID: 01f5cfc15d07900b94ec9b5f9cb6ab83a3422482eddf664c0123a7285cc754fa
Opcode Fuzzy Hash: 84b7be04bcb964f0c48824656df875d837866927ce70080593b1f37732907fbd
Instruction Fuzzy Hash: AF410275A00704AFFB24AF78DD45BAABFAAFBC8710F10452AF506DB292D37199018780

Function 005D56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 005D5783
GetLastError.KERNEL32(?,00000000), ref: 005D57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005D57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005D57FA

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 068010c0b9b55d826e5a4516f2369587af1270cb985075e80e962c202d2f65e3
Instruction ID: a9dfb80cd226b14109851d7486acf249636db8fca8fbcebeb545c5c2d4287c77
Opcode Fuzzy Hash: 068010c0b9b55d826e5a4516f2369587af1270cb985075e80e962c202d2f65e3
Instruction Fuzzy Hash: 33413C39200615DFCB20EF15C548A5DBFE2FF99324B188489E84A9B362DB34FD40DB91

Function 0059D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00586D71,00000000,00000000,005882D9,?,005882D9,?,00000001,00586D71,?,00000001,005882D9,005882D9), ref: 0059D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0059D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0059D9AB
__freea.LIBCMT ref: 0059D9B4

Part of subcall function 00593820: RtlAllocateHeap.NTDLL(00000000,?,00631444,?,0057FDF5,?,?,0056A976,00000010,00631440,005613FC,?,005613C6,?,00561129), ref: 00593852

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 9fba9eacd61f92c86561da9c1d656d2f7b961590725ba62be7f0d3e9c7d695d7
Instruction ID: e7063144fff3a1024aba1f0d1252928a4faa2146a6f3bfc6a35c71f459119eca
Opcode Fuzzy Hash: 9fba9eacd61f92c86561da9c1d656d2f7b961590725ba62be7f0d3e9c7d695d7
Instruction Fuzzy Hash: 89319D72A0020AABDF24EF64DC45EAE7FB5FB40350B054169FC04E6191EB39CD54CBA0

Function 005F52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 005F5352
GetWindowLongW.USER32(?,000000F0), ref: 005F5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005F5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005F53A8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: cb36eeeee64b8bc9c4d382ed3232cf0b505eff40018bab12b1564dc4ce13113b
Instruction ID: 3aba520d025a5b66d5884d3efc2af4d189000ee15f4aca51ab350390b8ce9a0e
Opcode Fuzzy Hash: cb36eeeee64b8bc9c4d382ed3232cf0b505eff40018bab12b1564dc4ce13113b
Instruction Fuzzy Hash: B831B234A55A0CEFEB309E1CCC05BF97F66BB05390F984911FB10961E1E7B89940EB42

Function 005CAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 005CABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 005CAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 005CAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 005CACC6

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e59d94273ef5c2f647f75dfcd89d22a93afe3c91f5fed207c32ef3ee74ef1cda
Instruction ID: 5667268cef7e3bcd721a815a7f7d3563c1118b0d13ca205e795d19947be742d4
Opcode Fuzzy Hash: e59d94273ef5c2f647f75dfcd89d22a93afe3c91f5fed207c32ef3ee74ef1cda
Instruction Fuzzy Hash: A2311230A4421CAFFF258BA88808FFA7FB5BB89318F04461EF481961D1C3788D859792

Function 005F7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 005F769A
GetWindowRect.USER32(?,?), ref: 005F7710
PtInRect.USER32(?,?,005F8B89), ref: 005F7720
MessageBeep.USER32(00000000), ref: 005F778C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4a2423bb8c176177217f418e9c585d6835406b1d9f3fa42f26c2569b11bbc20b
Instruction ID: e0128ddf44115b900c3d9263db1147e2dfd702066c51bb522715bbd9453eeecb
Opcode Fuzzy Hash: 4a2423bb8c176177217f418e9c585d6835406b1d9f3fa42f26c2569b11bbc20b
Instruction Fuzzy Hash: E2416B34A1A21DDFCB01EF58C894EB97BF6FB4D314F1540A8E614DB2A1C738A946CB90

Function 005F16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 005F16EB

Part of subcall function 005C3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005C3A57
Part of subcall function 005C3A3D: GetCurrentThreadId.KERNEL32 ref: 005C3A5E
Part of subcall function 005C3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005C25B3), ref: 005C3A65

GetCaretPos.USER32(?), ref: 005F16FF
ClientToScreen.USER32(00000000,?), ref: 005F174C
GetForegroundWindow.USER32 ref: 005F1752

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: cf7716039680e72223f2a820758d94126a13ee8ec300561f544166e73f776401
Instruction ID: 2dcb76957882bd93ba8b53739fe78c49a1f3b4ecaa3d63138fe2ac28bd5759ac
Opcode Fuzzy Hash: cf7716039680e72223f2a820758d94126a13ee8ec300561f544166e73f776401
Instruction Fuzzy Hash: 48313E75D01149AFCB04EFA9C985DAEBBF9FF88304B5080AAE415E7211DA359E45CBA0

Function 005CD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005CD501
Process32FirstW.KERNEL32(00000000,?), ref: 005CD50F
Process32NextW.KERNEL32(00000000,?), ref: 005CD52F
CloseHandle.KERNEL32(00000000), ref: 005CD5DC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5e6272ed59b7f1f228d16b3a589ebfb1c6d7674adabe0e3b32fd4858441e5cec
Instruction ID: b40460d08797d508162c0abf740808bfedfdff9b7f82a91e4ad51f0b48e7433f
Opcode Fuzzy Hash: 5e6272ed59b7f1f228d16b3a589ebfb1c6d7674adabe0e3b32fd4858441e5cec
Instruction Fuzzy Hash: C1318A711082019FD300EF94C885EABBFF8BFD9344F10092DF581831A1EB719948DBA2

Function 005F8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

GetCursorPos.USER32(?), ref: 005F9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,005B7711,?,?,?,?,?), ref: 005F9016
GetCursorPos.USER32(?), ref: 005F905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,005B7711,?,?,?), ref: 005F9094

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8e80427c245a7893569d098c13c19be5b02833cd59d5f9d17773b0a2b1c7b5ad
Instruction ID: c31ed13218f8adc85140c1a495b03204c974c09e226eeaf6f9604018fb9ef6dc
Opcode Fuzzy Hash: 8e80427c245a7893569d098c13c19be5b02833cd59d5f9d17773b0a2b1c7b5ad
Instruction Fuzzy Hash: D2214D3560041CAFDB158F94C858FFA7FBAFB8A350F144065F6058B2A1C7399990EB60

Function 005CD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,005FCB68), ref: 005CD2FB
GetLastError.KERNEL32 ref: 005CD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 005CD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,005FCB68), ref: 005CD376

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 1634343405a38a5f3e103361709bbbc43824764bb0937b5ee6bd31c079a9e0ec
Instruction ID: 6337b9ed5d767c6e4b902082461deffb45a9ebc5c3f81ab5032d5cb6d3469f8c
Opcode Fuzzy Hash: 1634343405a38a5f3e103361709bbbc43824764bb0937b5ee6bd31c079a9e0ec
Instruction Fuzzy Hash: A4217E745042069F8300DF68C9859AABFE8FE95764F504E2EF499C72A1D7309949CBA3

Function 005C1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005C102A
Part of subcall function 005C1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005C1036
Part of subcall function 005C1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005C1045
Part of subcall function 005C1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005C104C
Part of subcall function 005C1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005C1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 005C15BE
_memcmp.LIBVCRUNTIME ref: 005C15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C1617
HeapFree.KERNEL32(00000000), ref: 005C161E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 648170ec9756962ac928211c187d9cfcb469e972821f1e4f5b610c6315d12b9b
Instruction ID: e9941e9235fa7f6739d9389bb74882ae33398a5f65ff2b36368e7124334644ff
Opcode Fuzzy Hash: 648170ec9756962ac928211c187d9cfcb469e972821f1e4f5b610c6315d12b9b
Instruction Fuzzy Hash: 49216B71E00509AFDF10DFA4C949FEEBBB8FF46344F184459E441AB242D734AA45DB54

Function 005F2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 005F280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005F2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005F2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 005F2840

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: b77955aef27597ee89c3d7adfeecdb8218b0aa9af74e5926e0000e3bc416e29f
Instruction ID: b54222699e76222ddd919c2a57132a0fdaa2317a85a60f6023c8eee90a7d1429
Opcode Fuzzy Hash: b77955aef27597ee89c3d7adfeecdb8218b0aa9af74e5926e0000e3bc416e29f
Instruction Fuzzy Hash: 0D21E03120961AAFD7149B24C844FBA7F95FF85324F148158F526CB6E2CB79EC82CB90

Function 005C78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,005C790A,?,000000FF,?,005C8754,00000000,?,0000001C,?,?), ref: 005C8D8C
Part of subcall function 005C8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 005C8DB2
Part of subcall function 005C8D7D: lstrcmpiW.KERNEL32(00000000,?,005C790A,?,000000FF,?,005C8754,00000000,?,0000001C,?,?), ref: 005C8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,005C8754,00000000,?,0000001C,?,?,00000000), ref: 005C7923
lstrcpyW.KERNEL32(00000000,?), ref: 005C7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,005C8754,00000000,?,0000001C,?,?,00000000), ref: 005C7984

Strings

cdecl, xrefs: 005C797B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 64a44d1058301b26f8de4d64f04f592985212c1b84cf39daceb4a17830d1dd99
Instruction ID: 625a17c50bd027c3212c6ca5ac2ad480b75c8718219dbe68e35d94ec5e51931d
Opcode Fuzzy Hash: 64a44d1058301b26f8de4d64f04f592985212c1b84cf39daceb4a17830d1dd99
Instruction Fuzzy Hash: 6B11E93A200706AFCB159F74D845E7A7BE9FF99350B50402EF946C72A4EB319811DBA1

Function 005F7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 005F7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 005F7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 005F7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,005DB7AD,00000000), ref: 005F7D6B

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 89dd3bf8c5b67433c12caba48bc6b9ea0b799abcbe50db64e34708bcc7a6a390
Instruction ID: c314456aba5e0616a8474fc36bf9103eae579d48272a2ea4e2f0ecf5d3f83451
Opcode Fuzzy Hash: 89dd3bf8c5b67433c12caba48bc6b9ea0b799abcbe50db64e34708bcc7a6a390
Instruction Fuzzy Hash: 4D118E3150861DAFCB109F28DC04A763FA9BF4A360B558724F939CB2E0D7349951DB90

Function 005F5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 005F56BB
_wcslen.LIBCMT ref: 005F56CD
_wcslen.LIBCMT ref: 005F56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 005F5816

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: b50678ed1caae05022b515e7c55ef642a0a81a92a6946ac449bb9c55b61dc244
Instruction ID: 241822fe66dfd13facc37de0c514e3580df43b37e0e08f51a666f1a95e378067
Opcode Fuzzy Hash: b50678ed1caae05022b515e7c55ef642a0a81a92a6946ac449bb9c55b61dc244
Instruction Fuzzy Hash: 7811B471A0060D96DF20AF658C89AFE7FACFF51760F104526FB15DA081FB788984CB60

Function 00591D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00de3b3dc1eedc1222d657bfa1d057bd819aba542fe46911de15db29e413c563
Instruction ID: 7851dc2023c89b47f22d446f3e22ad0c0d83229927024e16891d79891e69f118
Opcode Fuzzy Hash: 00de3b3dc1eedc1222d657bfa1d057bd819aba542fe46911de15db29e413c563
Instruction Fuzzy Hash: FD018FB2205B2B7EFE1116786CC4F276E1DFF813B8F340725F525911D2DB608C4091A4

Function 005C1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 005C1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 005C1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 005C1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 005C1A8A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2c5d3ca5a1e91e7525ec47d3be3d193148386f820fdc4a622de4ca0e4b2beae4
Instruction ID: 3a9e620af4d2dadc03f5593c3b4630827e76d6652da84557f92aa0460ca6fa0c
Opcode Fuzzy Hash: 2c5d3ca5a1e91e7525ec47d3be3d193148386f820fdc4a622de4ca0e4b2beae4
Instruction Fuzzy Hash: D111273A901219FFEB109BA4CD85FADBB78FB08750F2000A5EA01B7290D6716E50DBD8

Function 005CE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005CE1FD
MessageBoxW.USER32(?,?,?,?), ref: 005CE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 005CE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 005CE24D

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3309e9e61a5f73d3a2044ec5e67351196d35250b32bbaf8856a8bcad648441bc
Instruction ID: 0868a0ab1a763835b1579053136234e189df1432df724bc7a7f3a505a73137dd
Opcode Fuzzy Hash: 3309e9e61a5f73d3a2044ec5e67351196d35250b32bbaf8856a8bcad648441bc
Instruction Fuzzy Hash: 1011C876904258BFD7019BE89C0AFAE7FADEB46320F044269F925E7291D6B48904D7A0

Function 0058D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0058CFF9,00000000,00000004,00000000), ref: 0058D218
GetLastError.KERNEL32 ref: 0058D224
__dosmaperr.LIBCMT ref: 0058D22B
ResumeThread.KERNEL32(00000000), ref: 0058D249

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 9173eadd305397d916474a837368af2d59ec5417881914fd4eb570ae4f5d4d4f
Instruction ID: 51c372e104617ce1518c6cdbfd184b3f3acfa41e100ac33f4edbc1a074e7e01c
Opcode Fuzzy Hash: 9173eadd305397d916474a837368af2d59ec5417881914fd4eb570ae4f5d4d4f
Instruction Fuzzy Hash: CC01C43A405109BBDB117BA5DC09AAA7FB9FF81330F100229FD26A21E0DB708905D7B0

Function 005F9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00579BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00579BB2

GetClientRect.USER32(?,?), ref: 005F9F31
GetCursorPos.USER32(?), ref: 005F9F3B
ScreenToClient.USER32(?,?), ref: 005F9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 005F9F7A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 00b01257dab84a717f4648c697d454ced5d0ab40fd7e35256b972fe9ebc8c662
Instruction ID: 325275a6e74b551b3556d96169d1060b2d509b8756773961598b8c999157b42e
Opcode Fuzzy Hash: 00b01257dab84a717f4648c697d454ced5d0ab40fd7e35256b972fe9ebc8c662
Instruction Fuzzy Hash: C011363290051EABDB01EF68D889AFE7BB9FB45311F000465FA01E7140D738BA85DBA1

Function 0056600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0056604C
GetStockObject.GDI32(00000011), ref: 00566060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0056606A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 357def233f3a2d8572625edd7318795403adbd5ef878a53ac5ca934d8eeb7dd9
Instruction ID: 6f706cf8fa5b9cf31cf21f7c24e91e701afc043a1336e883c65eb841e3d9af6c
Opcode Fuzzy Hash: 357def233f3a2d8572625edd7318795403adbd5ef878a53ac5ca934d8eeb7dd9
Instruction Fuzzy Hash: EB116D72501509BFEF125FA49C48EEABF6DFF193A4F040225FA1596110D7369C60EFA1

Function 00583B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00583B56

Part of subcall function 00583AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00583AD2
Part of subcall function 00583AA3: ___AdjustPointer.LIBCMT ref: 00583AED

_UnwindNestedFrames.LIBCMT ref: 00583B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00583B7C
CallCatchBlock.LIBVCRUNTIME ref: 00583BA4

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: b1e45e9f61b28039178b284043be76465bd39a86f9bd5f5c04ac6d7b07fcf8dd
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 3301E97210014ABBDF127E95CC4AEEB7F69FF98B54F044014FE4866121D732E961DBA0

Function 00593073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005613C6,00000000,00000000,?,0059301A,005613C6,00000000,00000000,00000000,?,0059328B,00000006,FlsSetValue), ref: 005930A5
GetLastError.KERNEL32(?,0059301A,005613C6,00000000,00000000,00000000,?,0059328B,00000006,FlsSetValue,00602290,FlsSetValue,00000000,00000364,?,00592E46), ref: 005930B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0059301A,005613C6,00000000,00000000,00000000,?,0059328B,00000006,FlsSetValue,00602290,FlsSetValue,00000000), ref: 005930BF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 215ca68ff72b04a2412afa49f0bfa57e173b460fbba8fdb98fd76a35ca0b54b2
Instruction ID: e371aed0b3e41ba370bd30dd9668b39832376031b4a84b5fc051c8d649a9484b
Opcode Fuzzy Hash: 215ca68ff72b04a2412afa49f0bfa57e173b460fbba8fdb98fd76a35ca0b54b2
Instruction Fuzzy Hash: 8F01F236341226EBDF314B78AC4CA6B7F99BF05BA1B210A24F916E7190D725DD09C6E0

Function 005C7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 005C747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 005C7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 005C74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 005C74CA

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e9f0b1cb9ef13884e346b42c3219a0e7850865902a2609aca82b0883810eb271
Instruction ID: b32e2d8adcfdf809dc54431619f374430ba8fe72ae9300b5b0842c702704dd59
Opcode Fuzzy Hash: e9f0b1cb9ef13884e346b42c3219a0e7850865902a2609aca82b0883810eb271
Instruction Fuzzy Hash: 94117CB52053189FEB208F94DD49FA2BFB8FB04B00F10856DA626D6551D7B4E908EF50

Function 005CB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,005CACD3,?,00008000), ref: 005CB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,005CACD3,?,00008000), ref: 005CB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,005CACD3,?,00008000), ref: 005CB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,005CACD3,?,00008000), ref: 005CB126

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 68135cdacf6463d51751807138e3004fcf649fd419ce349046d2b893075d6005
Instruction ID: bfe69289bf87f38b1a9cd5beb2bedea2728da933dd724b8cb3b4f0c8a2c7679f
Opcode Fuzzy Hash: 68135cdacf6463d51751807138e3004fcf649fd419ce349046d2b893075d6005
Instruction Fuzzy Hash: 8B112731C0162DEBDF00AFE4E95ABEEBF78BF59711F104499D941B2181CB345A60DB52

Function 005F7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005F7E33
ScreenToClient.USER32(?,?), ref: 005F7E4B
ScreenToClient.USER32(?,?), ref: 005F7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F7E8A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 5f4fb9d7d1d7e9ea4cdb529907b80c20687d9bc7f9392a657f8082065d9f33a5
Instruction ID: 43a5acfa1b010074bfc7ac9334a5311ab49df9e15ff738f4098f2465a49b0feb
Opcode Fuzzy Hash: 5f4fb9d7d1d7e9ea4cdb529907b80c20687d9bc7f9392a657f8082065d9f33a5
Instruction Fuzzy Hash: C91143B9D0420EAFDB41DFA8C9849EEBBF9FB18310F505066E915E2210D735AA54DF90

Function 005C2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 005C2DD6
GetCurrentThreadId.KERNEL32 ref: 005C2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 005C2DE4

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 3c232ca72dd375fe704d20e40d4316d48c83e5255fa4c036084b4600607e761b
Instruction ID: a06f7995893a3b3afbe51ab40106b260c08e98c50a4c3e24a7d290f78fa53827
Opcode Fuzzy Hash: 3c232ca72dd375fe704d20e40d4316d48c83e5255fa4c036084b4600607e761b
Instruction Fuzzy Hash: 6EE092B11052287BD7201BB69D0DFFB3E6CFF63BA1F000429F106D10809AA8C845E6B0

Function 005F8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00579639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00579693
Part of subcall function 00579639: SelectObject.GDI32(?,00000000), ref: 005796A2
Part of subcall function 00579639: BeginPath.GDI32(?), ref: 005796B9
Part of subcall function 00579639: SelectObject.GDI32(?,00000000), ref: 005796E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 005F8887
LineTo.GDI32(?,?,?), ref: 005F8894
EndPath.GDI32(?), ref: 005F88A4
StrokePath.GDI32(?), ref: 005F88B2

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7184e179e3d2e94d2cfba046d176cff0cbb1019a0d27e264b61cd440556112e8
Instruction ID: b88545c6241f6020554905162b2b29fb4f3f67ebd3df6af7ec623ad6778cfae4
Opcode Fuzzy Hash: 7184e179e3d2e94d2cfba046d176cff0cbb1019a0d27e264b61cd440556112e8
Instruction Fuzzy Hash: 4BF03A3604125DBADB126F94AD0DFEE3E59AF16310F048110FA11A50E1CB795526EBE5

Function 005798B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 005798CC
SetTextColor.GDI32(?,?), ref: 005798D6
SetBkMode.GDI32(?,00000001), ref: 005798E9
GetStockObject.GDI32(00000005), ref: 005798F1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: b01524a153d132cf72002731eeadfa969e9be257e221b542f37a344d15336399
Instruction ID: b8be9cb3be8572e6bafc4870a3a5bbbadd411f3026f8d85ec7c4efb7fb0a8b0b
Opcode Fuzzy Hash: b01524a153d132cf72002731eeadfa969e9be257e221b542f37a344d15336399
Instruction Fuzzy Hash: 49E06531244648AADB215B74BD09BF83F10FB66336F148229F6FA980E1C3755654EB10

Function 005C162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 005C1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,005C11D9), ref: 005C163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005C11D9), ref: 005C1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,005C11D9), ref: 005C164F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 564eb61bf28a695eed2b7dd5e563ad85bed687f7b73e9db28568c35fdbe35855
Instruction ID: 6123960d417fcc7ee30d939595e43c791cb5ed0011ed30674a792371d2289e96
Opcode Fuzzy Hash: 564eb61bf28a695eed2b7dd5e563ad85bed687f7b73e9db28568c35fdbe35855
Instruction Fuzzy Hash: 2DE04F326412159BD7205BF09E0DF6A3F6CAF65791F144828F245C9080DA284489D754

Function 005BD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 005BD858
GetDC.USER32(00000000), ref: 005BD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 005BD882
ReleaseDC.USER32(?), ref: 005BD8A3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: bcc90fed65f17eb446f12aff020ab3238ca4e5ec40f4ac4edc4b154cf6097e6b
Instruction ID: 7d722a33b8ce49a561f9b5a3b7f56dd7d7dcc5e7d903b70ac2cfca995dfb685f
Opcode Fuzzy Hash: bcc90fed65f17eb446f12aff020ab3238ca4e5ec40f4ac4edc4b154cf6097e6b
Instruction Fuzzy Hash: 54E0E5B4804209DFCB419FA49A0CA7DBFB5BB18311B108429E846E7350DB385909EF50

Function 005BD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 005BD86C
GetDC.USER32(00000000), ref: 005BD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 005BD882
ReleaseDC.USER32(?), ref: 005BD8A3

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 4c094a855a07701d35e0d47128922b5535a10c7b158a6a188e1b56d7bc772054
Instruction ID: 9e557f0b5a2e6875373cddd281d55317b743979fde931786a6bfaf784b0a5ddb
Opcode Fuzzy Hash: 4c094a855a07701d35e0d47128922b5535a10c7b158a6a188e1b56d7bc772054
Instruction Fuzzy Hash: 63E01A74804208DFCB409FA4D90C67DBFB5BB18310B108418E84AE7350CB3C5909EF50

Function 005D4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00567620: _wcslen.LIBCMT ref: 00567625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 005D4ED4

Strings

*, xrefs: 005D4E10
LPT, xrefs: 005D4DFB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 885f41f9fba015283cfd0163f2679d77b44f73f1c61b27ee71e0bfe8b0b1444a
Instruction ID: e67fc5c7f860d6c919dba683efb339fa34c36451301edb5018470ffae896fac2
Opcode Fuzzy Hash: 885f41f9fba015283cfd0163f2679d77b44f73f1c61b27ee71e0bfe8b0b1444a
Instruction Fuzzy Hash: 2B912C75A002459FCB24DF58C484EAABFF5BF48304F19809AE80A9B362D735ED85CF91

Function 0058E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0058E30D

Strings

pow, xrefs: 0058E2E5, 0058E302

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 7d683854f77b844ffde2188b91955ede535df5f1d62097aae79406e97e5ad3ee
Instruction ID: fac68cedfa8fb217bb51e79a7af0e0618d1a716e2989b0f7ad4c078aa635bee4
Opcode Fuzzy Hash: 7d683854f77b844ffde2188b91955ede535df5f1d62097aae79406e97e5ad3ee
Instruction Fuzzy Hash: 00515C61A5C20B96CF157728CD0637A3FB8FF44740F344D9AE896522E9EF348C919B46

Function 005E7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(005B569E,00000000,?,005FCC08,?,00000000,00000000), ref: 005E78DD

Part of subcall function 00566B57: _wcslen.LIBCMT ref: 00566B6A

CharUpperBuffW.USER32(005B569E,00000000,?,005FCC08,00000000,?,00000000,00000000), ref: 005E783B

Strings

<sb, xrefs: 005E77C8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sb
API String ID: 3544283678-1973350311
Opcode ID: 06d23966fff48ab8c0cb2023f4d8f0434d07ec7de9b49a03146230be0d66e298
Instruction ID: 4ced9952c0c88e3fdf55c1ac5b3f04750fb75e5991ad2aeb429893d26111e7bc
Opcode Fuzzy Hash: 06d23966fff48ab8c0cb2023f4d8f0434d07ec7de9b49a03146230be0d66e298
Instruction Fuzzy Hash: 15616E3291415EAACF08EBA5CC95DFDBB78BF68300F544525F582B3192EF305A05DBA0

Function 0057E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0057E1B1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 0de93f3d6248d6636508b5177f99663bd3e4440207364f19e4693209d51e4923
Instruction ID: 682904dd5ba35fee3402650be0a2c6910aef2e81780443d3b6e8770be6ed9095
Opcode Fuzzy Hash: 0de93f3d6248d6636508b5177f99663bd3e4440207364f19e4693209d51e4923
Instruction Fuzzy Hash: F1513439504386EFDB15DF68D0476FA7FA4FF59310F288055E8919B291DA30AD42DB90

Function 0057F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0057F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0057F2BB

Strings

@, xrefs: 0057F2AF

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: b47fab77e9e1607512bfb96e329a6c8eddef72fb6b873565b090e584a40d1067
Instruction ID: 861b1752e8a74e7544d73fd0b0f7d2f70627e49f588ba672882a8c771df705db
Opcode Fuzzy Hash: b47fab77e9e1607512bfb96e329a6c8eddef72fb6b873565b090e584a40d1067
Instruction Fuzzy Hash: 5B517A714187499BD320AF50DC8ABABBBF8FBC4304F81885DF1D942195EF718529CB66

Function 005E5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 005E57E0
_wcslen.LIBCMT ref: 005E57EC

Strings

CALLARGARRAY, xrefs: 005E57E6, 005E57EB

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 51e5b0b3bb6d600931ab8d81cae6f5abd3a16e99cd4eebf664b7091eccf24bf8
Instruction ID: fe9e2c8a1169305d177286e1c9b03670951c6de42cafb29d1a08460a53d327b3
Opcode Fuzzy Hash: 51e5b0b3bb6d600931ab8d81cae6f5abd3a16e99cd4eebf664b7091eccf24bf8
Instruction Fuzzy Hash: 9441B031A0420A9FCB18DFA9C8859BEBFF5FF99318F204169E545A7291E7309D81CB90

Function 005DD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005DD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 005DD13A

Strings

|, xrefs: 005DD10B

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 625541435a44d72e91f9921ef07d478c80f1cb41ba14f7c2aeba5a790241199b
Instruction ID: 3235d0c3b749f134e04994748ec00d627faafbb0c6654b89edce4fa44d4c40ac
Opcode Fuzzy Hash: 625541435a44d72e91f9921ef07d478c80f1cb41ba14f7c2aeba5a790241199b
Instruction Fuzzy Hash: 6F311E71D0011AABCF15EFA4CC89AEFBFB9FF44300F10011AF815A6265D731AA56DBA0

Function 005F356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 005F3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 005F365C

Strings

static, xrefs: 005F35BC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: e7a1cbfc1fd60e354720e3da6aefed38e611452ae8ed9123999f77ebbeac8897
Instruction ID: 3c84697098aef572b315b538cfb0bbc7687bcd66b66cf08c6c924715c90e93e6
Opcode Fuzzy Hash: e7a1cbfc1fd60e354720e3da6aefed38e611452ae8ed9123999f77ebbeac8897
Instruction Fuzzy Hash: 9E319071100208AEEB109F68DC84EFB7BA9FF88724F009619F9A5D7290DB34ED81D760

Function 005F4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 005F461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005F4634

Strings

', xrefs: 005F458E

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 3db76724708e806c864488fcce00689960cafd6eef07a18ecf40d7092853d040
Instruction ID: 94221756313b872fb21ea388f38ed6a19b9d66441e63bdca6233c2672f49f9f8
Opcode Fuzzy Hash: 3db76724708e806c864488fcce00689960cafd6eef07a18ecf40d7092853d040
Instruction Fuzzy Hash: B1311874A0120E9FDB14DFA9C990BEA7BB5FF49300F14406AEA05EB391D774A941DF90

Function 005F31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 005F327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F3287

Strings

Combobox, xrefs: 005F3249

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 35bf7d1e2fdb077c07a0654624ba1ab4dc574ced71c71ce2f3ceee40868f1cbb
Instruction ID: ce9d31b390eec7100413adaf2476d4771c4cbfa147f157dec35f87383262c922
Opcode Fuzzy Hash: 35bf7d1e2fdb077c07a0654624ba1ab4dc574ced71c71ce2f3ceee40868f1cbb
Instruction Fuzzy Hash: 8611907520020D6FFF219E54DC84EBB3B6BFB94364F104525FA189B290D6399D519B60

Function 005F3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0056600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0056604C
Part of subcall function 0056600E: GetStockObject.GDI32(00000011), ref: 00566060
Part of subcall function 0056600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0056606A

GetWindowRect.USER32(00000000,?), ref: 005F377A
GetSysColor.USER32(00000012), ref: 005F3794

Strings

static, xrefs: 005F3757

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 82ff1f0a82ced27e24051a0c946ce3b84362c9606590f821c48ac40823ec8ea5
Instruction ID: 476140dc1fbd09848a8572f7dcac7d52155c75cceaabc1956d5e77399493ef1d
Opcode Fuzzy Hash: 82ff1f0a82ced27e24051a0c946ce3b84362c9606590f821c48ac40823ec8ea5
Instruction Fuzzy Hash: BF112CB261020EAFEB00DFA8CC45EFA7BB8FB08314F004924FA55E2250E739E955DB50

Function 005DCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 005DCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 005DCDA6

Strings

<local>, xrefs: 005DCD66

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: fa378bde27c1a0bd0f1e7c7bb29512d399b773c8ea407c30582a130d46c5f4e9
Instruction ID: f1df3fc5e6efe2f13caef3f37f8b47636f7349281fb7f139b145bc209550de17
Opcode Fuzzy Hash: fa378bde27c1a0bd0f1e7c7bb29512d399b773c8ea407c30582a130d46c5f4e9
Instruction Fuzzy Hash: B111A3712056767AD7386A6A8C45EF7BE6AFF227A4F00463BB109C3280D6649844D6F0

Function 005F3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 005F34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 005F34BA

Strings

edit, xrefs: 005F348F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 9ccb1872a2fa7b486cea5ef1f80aca6be98320d8a0e17baad088249ba01d5882
Instruction ID: 8ce3931a164940623365f708b4b526ff6a4f5e5e22640e2b85e48ea11521ac79
Opcode Fuzzy Hash: 9ccb1872a2fa7b486cea5ef1f80aca6be98320d8a0e17baad088249ba01d5882
Instruction Fuzzy Hash: 2011587110020CAAFF128E64DC4CABA3E6AFB55374F504724FA61971E4C679EC51AB60

Function 005C6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

CharUpperBuffW.USER32(?,?,?), ref: 005C6CB6
_wcslen.LIBCMT ref: 005C6CC2

Strings

STOP, xrefs: 005C6CBC, 005C6CC1

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: d88d1dddce5ebd071044378664f03747f423da4d0f9006fa156c10dbcc7bb3a1
Instruction ID: 0045f6201a8450c9bd7880892631f5b14fc8dfaf97c1e34a8608586a2e379ce1
Opcode Fuzzy Hash: d88d1dddce5ebd071044378664f03747f423da4d0f9006fa156c10dbcc7bb3a1
Instruction Fuzzy Hash: 8D01A1326005278ECB20AEFDDC85EBF7FA9BAA1710B500928E86297194EA31DE00C650

Function 005C1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005C3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 005C3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 005C1D4C

Strings

ComboBox, xrefs: 005C1CEB
ListBox, xrefs: 005C1D16

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7721df9fc4016e478f13ea209d7cfae2f81db4cf8c3311869fc1e83783e6901e
Instruction ID: 1900713ca0a03cee1dccc13b845fd54f856544ee741ae211e51f5e64b88418f0
Opcode Fuzzy Hash: 7721df9fc4016e478f13ea209d7cfae2f81db4cf8c3311869fc1e83783e6901e
Instruction Fuzzy Hash: 2601D871601619AFCB14EBE4CD55EFE7B69FF97350B14091DF823572C2EA309908D660

Function 005C1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005C3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 005C3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 005C1C46

Strings

ComboBox, xrefs: 005C1BE5
ListBox, xrefs: 005C1C10

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a4da5602cc0a26637b31af18c1eea392ee45197c7f0d372637a4bc21827ce570
Instruction ID: 78f451795d9a4b3710671a2a324d11efc108fa158cb30d55e21883d8bba3441e
Opcode Fuzzy Hash: a4da5602cc0a26637b31af18c1eea392ee45197c7f0d372637a4bc21827ce570
Instruction Fuzzy Hash: 0F0184756815096BDB14EBD0CA59EFF7BACBF52340F14002DB40667282EA349E18E6B5

Function 005C1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005C3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 005C3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 005C1CC8

Strings

ComboBox, xrefs: 005C1C69
ListBox, xrefs: 005C1C94

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1e7e461f4643cf684ad3559a3da45c58aa73b308b3a2afaa03bb0b2da4dd2921
Instruction ID: e332677a1330159ab768cfbf18adb9a6f1b881e7f6f61d7cccde2f95ee3852d4
Opcode Fuzzy Hash: 1e7e461f4643cf684ad3559a3da45c58aa73b308b3a2afaa03bb0b2da4dd2921
Instruction Fuzzy Hash: D101A7716405196BDB14E7D4CB16FFE7BACBB52380F140019B802B7282EA349F18D675

Function 0057A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0057A529

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Strings

,%c, xrefs: 0057A509
3y[, xrefs: 0057A545, 0057A54D, 0057A552

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%c$3y[
API String ID: 2551934079-398146797
Opcode ID: 213bb80f93d2f9e68f77212b3c3ffabc26fbf833c0ad251bfb8a7b05ae70a24c
Instruction ID: 06983ac01a4867ccf338dc560411359e3abdb96856911f952fa0b18e90911e66
Opcode Fuzzy Hash: 213bb80f93d2f9e68f77212b3c3ffabc26fbf833c0ad251bfb8a7b05ae70a24c
Instruction Fuzzy Hash: BF01F73170061687CE00F768E81FA6D3F59BBC5720F404424F50A671C2DE615E0596D7

Function 005C1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00569CB3: _wcslen.LIBCMT ref: 00569CBD

Part of subcall function 005C3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 005C3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 005C1DD3

Strings

ComboBox, xrefs: 005C1D75
ListBox, xrefs: 005C1DA0

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7a8e7d6165e9fd44322bd966f9caeaae21272d13f41c7d9d81500e4ac0b1c413
Instruction ID: e3fac83590bd84e529aad91cf56e2c02475f0202fed618a501ac8675df56cf41
Opcode Fuzzy Hash: 7a8e7d6165e9fd44322bd966f9caeaae21272d13f41c7d9d81500e4ac0b1c413
Instruction Fuzzy Hash: DDF0F471A4061A6BDB14F7E4CD56FFE7F6CBF52340F040919B823A72C2DA7059088664

Function 005F8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00633018,0063305C), ref: 005F81BF
CloseHandle.KERNEL32 ref: 005F81D1

Strings

\0c, xrefs: 005F818A

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0c
API String ID: 3712363035-2434402519
Opcode ID: b1c40808b5a8a91a49393ce206a3187b4ecaa73f94b4b69ec96f5ffad156b37c
Instruction ID: 126996d097de2999409e8fcc16b4bc9c68ecfb07c058b0641b261643501ad5d6
Opcode Fuzzy Hash: b1c40808b5a8a91a49393ce206a3187b4ecaa73f94b4b69ec96f5ffad156b37c
Instruction Fuzzy Hash: 20F089B1640314BEF3146B616C45F773E5DEB14755F000420BF08D52A1D7798E0497F4

Function 005E747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005E7493
_wcslen.LIBCMT ref: 005E74B9

Strings

3, 3, 16, 1, xrefs: 005E7483

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 5bd64408089457b0c33b66c62b28e9e39183167ad072b714a94e6b9840019280
Instruction ID: 426cd6801a4467da3479ab39ba027acdc088e0709e6778f100cc7f86e430547a
Opcode Fuzzy Hash: 5bd64408089457b0c33b66c62b28e9e39183167ad072b714a94e6b9840019280
Instruction Fuzzy Hash: 37E02B02205362109735227BACC597F5E8AFFCD750710182BFDC5D22A6EA94CD9193A0

Function 005C0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 005C0B23

Strings

AutoIt, xrefs: 005C0B17
Error allocating memory., xrefs: 005C0B1C

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 11dfdc35b75b8490e4fd275873a74e92af50a6a9ad93d5e527669124084cef5b
Instruction ID: 7c66b404712c7eaed34b6381d38a28a165ba99ea12e16123d43234f2f561d6e6
Opcode Fuzzy Hash: 11dfdc35b75b8490e4fd275873a74e92af50a6a9ad93d5e527669124084cef5b
Instruction Fuzzy Hash: A7E0D83128531D2AD22476947D07F997E88EF05B14F10443AFB58954C38AE168909BE9

Function 00580D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0057F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00580D71,?,?,?,0056100A), ref: 0057F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0056100A), ref: 00580D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0056100A), ref: 00580D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00580D7F

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: dffa72fbde9943252964571b6e1ec377e6304f4d1c53dff3f1c38e16973e22d7
Instruction ID: bc1cc81d832ad75bf29dfb73065c22f6211f44de96980714c20c1deb4a62d7da
Opcode Fuzzy Hash: dffa72fbde9943252964571b6e1ec377e6304f4d1c53dff3f1c38e16973e22d7
Instruction Fuzzy Hash: B1E06D742003018BE7A0AFB8E5083567FE4FF10744F00992DE986D7691EBB9E448DB91

Function 0057E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0057E3D5

Strings

0%c, xrefs: 0057E3B5
8%c, xrefs: 0057E3CA

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%c$8%c
API String ID: 1385522511-2241630064
Opcode ID: 6b7752528325d1f53a0aa6110a632fa6ccf30cd0531060b2e878516e26fd0baf
Instruction ID: 67c6a719a66af3a58f20a1e953c9ba64d295d5eb7df54dc5518f6cac8ec89c28
Opcode Fuzzy Hash: 6b7752528325d1f53a0aa6110a632fa6ccf30cd0531060b2e878516e26fd0baf
Instruction Fuzzy Hash: 6DE08632414B22CBC704EB18FC7EB883B57BB4D330B5069E5E656971D19B703A41A7D5

Function 005D3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 005D302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 005D3044

Strings

aut, xrefs: 005D3038

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e168724e0a51347c72c94badaf26bb9f4cc5eba589b77d9146494b25b575626c
Instruction ID: 1e940e852701f797a45fa78a1f15af35249c28f0346693676e9785994a9c677b
Opcode Fuzzy Hash: e168724e0a51347c72c94badaf26bb9f4cc5eba589b77d9146494b25b575626c
Instruction Fuzzy Hash: A8D05E76500328A7DA20A7A4AD0EFDB3E6CDB04750F0002A1B695E20A2DAB49988CBD0

Function 005BD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005BD220

Strings

%.3d, xrefs: 005BD22B
X64, xrefs: 005BD2A8

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: fd059863c2af59919ad023e1ab6fb6f26432596d807497d041f065b827154337
Instruction ID: 34343c8f7c46b8443e5e285ae1a2e95d0315846feea511c64a0db480d01997e8
Opcode Fuzzy Hash: fd059863c2af59919ad023e1ab6fb6f26432596d807497d041f065b827154337
Instruction Fuzzy Hash: 9FD0EC69809159E9CA90D7909C498F9FB7CBB58301F508862F90A91040F628E508AB71

Function 005F2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005F236C
PostMessageW.USER32(00000000), ref: 005F2373

Part of subcall function 005CE97B: Sleep.KERNELBASE ref: 005CE9F3

Strings

Shell_TrayWnd, xrefs: 005F2365

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 266d908a729215fa93ed859c34adf18d6ec7d198078491b2dcc4197db8aaeb4a
Instruction ID: e1794f9ad4d565db3191e8d53eba52c03f8909f8c78a67360ad4f66f564bec3b
Opcode Fuzzy Hash: 266d908a729215fa93ed859c34adf18d6ec7d198078491b2dcc4197db8aaeb4a
Instruction Fuzzy Hash: 08D0A9323803147AE264A370EC0FFC66A25AB11B00F0009267201EA0D0C8B4A804CA04

Function 005F2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005F232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 005F233F

Part of subcall function 005CE97B: Sleep.KERNELBASE ref: 005CE9F3

Strings

Shell_TrayWnd, xrefs: 005F2325

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ca08353639a770fafcebf6015e4ad2530295be36e25999466c19f17d9087e5fa
Instruction ID: 7e5af1a6557a55a3a592eea8497b5fc46d74d9071479a67da0ea7028de545e2a
Opcode Fuzzy Hash: ca08353639a770fafcebf6015e4ad2530295be36e25999466c19f17d9087e5fa
Instruction Fuzzy Hash: 21D0A932384314BAE264A370EC0FFD66E25AB10B00F0009267205EA0D0C8B4A804CA00

Function 0059BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0059BE93
GetLastError.KERNEL32 ref: 0059BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0059BEFC

Memory Dump Source

Source File: 00000000.00000002.2899525408.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2899463088.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899762800.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899893142.000000000062C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2899934483.0000000000634000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ecffddb9aeed743fd0c5ec407bc505599d895b9db267a7d2999626d19f21b7c1
Instruction ID: 671edf4e545420d6b21ab2014d968c9b84769729797e3c3031f29847b1854622
Opcode Fuzzy Hash: ecffddb9aeed743fd0c5ec407bc505599d895b9db267a7d2999626d19f21b7c1
Instruction Fuzzy Hash: AF41E63460020AEFFF219F64EE84ABA7FA9FF41310F144169F959971A1DB308D00DB50

Source: global traffic	TCP traffic: 192.168.2.4:58900 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 23.55.235.170 23.55.235.170
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725624491&P2=404&P3=2&P4=j1BbytyHTndJcZ0VXyMHn6AqM%2fwglnbtYM9gmT8ikZHW8okmO2qUdCp4Kful9ngSIw6zTN%2fl1lET303SIkT54A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: RJAAuMBgay7ripIPMra0jKSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bdyh3LYKrut4ddd&MD=zmbULpMs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725624491&P2=404&P3=2&P4=j1BbytyHTndJcZ0VXyMHn6AqM%2fwglnbtYM9gmT8ikZHW8okmO2qUdCp4Kful9ngSIw6zTN%2fl1lET303SIkT54A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: RJAAuMBgay7ripIPMra0jKSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bdyh3LYKrut4ddd&MD=zmbULpMs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.196
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.196

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0b12ad59-7520-4211-97df-39eb31d23a99.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1c5809d2-7e64-48cb-9006-57efa6c99ff7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\218b5ea1-8ec9-409b-9c88-d79cc45e5bf2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\60babd47-9a3f-42d7-afcf-9a72b3041278.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8e53e734-8ac5-4729-b953-c361d56cdb58.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\492ae01a-c27e-4765-9baf-f22d52fd04c5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1B618-14C0.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D1B618-57C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\05f71bc6-8476-4b6c-a24e-712c87b6abf2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1f3c8e5a-0a54-4061-904a-596c5ea78179.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\23b09d90-f7c4-4e1f-828d-e0ee8be4e884.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3c3b6b81-4d88-4111-b002-16dad65644c9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\65c17a41-1202-4824-a05a-30cd6e8b6f3e.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre