Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502156
MD5:	baaed183eb33ca6aca19800f393a4c1e
SHA1:	83bfece6cf93eff7d036a5bf7bdf81f6f7161808
SHA256:	377cfca92e30bf58d3e736aa75e7341c7ad9a5962331e46ae25971e81b632d81
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7068 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BAAED183EB33CA6ACA19800F393A4C1E)

msedge.exe (PID: 7084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2028,i,7254388332489969249,207253126821642680,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2688 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4876 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8572 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5316 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8656 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8676 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 7928 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8204 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2084,i,7263840641758867396,8951152612680073893,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7680 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2100,i,1304964581190080565,2805568781063090699,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,1315791386614883166,3339614871798529016,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2901158847.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2901158847.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: d60bedd5-3738-4176-aa56-c2058374d1c0.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: d60bedd5-3738-4176-aa56-c2058374d1c0.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2901099434.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d60bedd5-3738-4176-aa56-c2058374d1c0.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49791 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00AAEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00AAED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00AAEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A9AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00A9AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00AC9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1647796123.0000000000AF2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_018f0345-9
Source: file.exe, 00000000.00000000.1647796123.0000000000AF2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3bc62db0-c
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b6ad31c7-7
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f0f0f450-b

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A9D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00A9D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A91201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A91201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A9E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A9E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A38060	0_2_00A38060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA2046	0_2_00AA2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98298	0_2_00A98298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6E4FF	0_2_00A6E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6676B	0_2_00A6676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC4873	0_2_00AC4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5CAA0	0_2_00A5CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3CAF0	0_2_00A3CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4CC39	0_2_00A4CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66DD9	0_2_00A66DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4D064	0_2_00A4D064
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A391C0	0_2_00A391C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4B119	0_2_00A4B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51394	0_2_00A51394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51706	0_2_00A51706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5781B	0_2_00A5781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A519B0	0_2_00A519B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A37920	0_2_00A37920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4997D	0_2_00A4997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A57A4A	0_2_00A57A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A57CA7	0_2_00A57CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51C77	0_2_00A51C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A69EEE	0_2_00A69EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABBE44	0_2_00ABBE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51F32	0_2_00A51F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A50A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A4F9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@98/523@22/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA37B5 GetLastError,FormatMessageW,

0_2_00AA37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A910BF AdjustTokenPrivileges,CloseHandle,		0_2_00A910BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A916C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A916C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00AA51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00ABA67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00AA648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A342A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00A342A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d0f31441-8b5b-4a35-b27e-03d995b8d0d5.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2028,i,7254388332489969249,207253126821642680,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2688 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4876 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5316 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2084,i,7263840641758867396,8951152612680073893,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2100,i,1304964581190080565,2805568781063090699,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,1315791386614883166,3339614871798529016,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2028,i,7254388332489969249,207253126821642680,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2688 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4876 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5316 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2084,i,7263840641758867396,8951152612680073893,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2100,i,1304964581190080565,2805568781063090699,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,1315791386614883166,3339614871798529016,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A342DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A50A76 push ecx; ret

0_2_00A50A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00A4F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00AC1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96099

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6498

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.9 %

Source: C:\Users\user\Desktop\file.exe TID: 7060

Thread sleep time: -64980s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6498 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A9DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA68EE FindFirstFileW,FindClose,	0_2_00AA68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00AA698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A9D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A9D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AA9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AA979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00AA9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00AA5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A342DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96028

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAEAA2 BlockInput,

0_2_00AAEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A62622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A62622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A342DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A54CE8 mov eax, dword ptr fs:[00000030h]

0_2_00A54CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A90B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00A90B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A62622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A62622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A5083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A509D5 SetUnhandledExceptionFilter,	0_2_00A509D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A50C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A50C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00A91201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A72BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A72BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A4F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00A4F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00AB22DA

Source: C:\Users\user\Desktop\file.exe

0_2_00A90B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A91663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A91663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A50698 cpuid

0_2_00A50698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AA8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00AA8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A8D27A GetUserNameW,

0_2_00A8D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A6BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00A6BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A342DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00AB1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00AB1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	21%	ReversingLabs
file.exe	22%	Virustotal	Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
s-part-0029.t-0009.t-msedge.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://msn.com	0%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://drive.google.com/	0%	Virustotal		Browse
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.185.225	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	0%, Virustotal, Browse	unknown
s-part-0029.t-0009.t-msedge.net	13.107.246.57	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	d60bedd5-3738-4176-aa56-c2058374d1c0.tmp.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2901099434.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.68	unknown	United States	15169	GOOGLEUS	false
23.55.235.170	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.81.238	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.65.174	unknown	United States	15169	GOOGLEUS	false
13.107.246.57	s-part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502156
Start date and time:	2024-08-31 09:38:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@98/523@22/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 41 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 74.125.71.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.186.99, 172.217.16.195, 2.23.209.131, 2.23.209.135, 2.23.209.186, 2.23.209.132, 2.23.209.187, 2.23.209.133, 2.23.209.130, 2.23.209.140, 2.23.209.189, 20.223.35.26, 93.184.221.240, 192.229.221.95, 142.250.186.142, 216.58.206.42, 142.250.185.234, 172.217.18.10, 142.250.186.42, 172.217.16.202, 172.217.16.138, 142.250.74.202, 142.250.186.74, 142.250.186.138, 216.58.206.74, 142.250.184.202, 216.58.212.170, 142.250.181.234, 142.250.185.74, 172.217.18.106, 216.58.212.138, 142.251.40.227, 142.250.80.99, 142.250.65.195, 142.250.65.163, 142.251.40.163, 142.250.80.35
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:39:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
08:39:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
08:39:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
08:39:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.55.235.170	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	lmiXXjKzpz.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.19912.30037.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.21247.5426.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://spo.devgdmsuk.com/authorize	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://4271c5088749124ef40631cb8.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1lNDkwZjQyMi03YTgzLTQxZGUtOTA0My00NzMwNDhhZDBiOTUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://security-us.m.mimecastprotect.com/ttpwp/?tkn=3.0JfxfH8ssmm4IH6cwCFt-D9qW8OfbSAI3GS_btQfQlhldgcwCnCLHOyJ29U3WB7DtC_DhQgg-MQmn_Q3nA6YAOMW_gWm7KyNL-ia48d-H6d4D5ATg5kL5M3JPWyG3CkSJb5TEl4olwCIO6QZGRmDfJp48aiZoORuXZ_tdiGfAoM.wnVN2YKcNuAslAQ06pDpdg#/enrollment?key=7aeab67f-ce32-30f5-9feb-9cd16579fa82	Get hash	malicious	Unknown	Browse	13.107.246.60
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	140-DEMNADA LABORAL- JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL.svg	Get hash	malicious	AsyncRAT	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	https://xjp.steamproxy.vip/profiles/76561199276106401	Get hash	malicious	Unknown	Browse	2.16.241.11
	https://xjp.steamproxy.vip/id/sircapthe4th	Get hash	malicious	Unknown	Browse	2.16.238.136
	https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/trinitybiblechurch.za.org/.css/9gKijWfa/ZGhvcm5lQGFkdmVudGhwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	172.233.33.245
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	https://psr22kzz.r.us-gov-west-1.awstrack.me/L0/https:%2F%2Femp.eduyield.com%2Fel%3Faid=28gedda0e6c-1865-11ef-80aa-0217a07992df%26rid=33766156%26pid=771868%26cid=497%26dest=google.com.%2F%2F%2F%2Famp%2Fs%2Fthaiphong.com.vn%2F.dev%2FHFCLZmcs%2FYWRhbS5jaHJpc3RlbnNlbkBmaXJzdG9udGFyaW8uY29t$%25C3%25A3%25E2%2582%25AC%25E2%2580%259A/1/010a0191a45eb314-d1d171f9-2b22-4ead-907f-02978cc6b519-000000/WkkXclN42Mw-lBF1nQh309Ynorc=1	Get hash	malicious	HTMLPhisher	Browse	172.233.33.245
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	IrisMichael263Fiona.lib.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	http://flow-energy-3109.my.salesforce.com	Get hash	malicious	Unknown	Browse	104.18.32.137
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://found.ee/5PKNr	Get hash	malicious	Unknown	Browse	104.18.11.207
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	SecuriteInfo.com.Linux.Siggen.9999.15938.22369.elf	Get hash	malicious	Mirai	Browse	20.65.255.2
	SecuriteInfo.com.Linux.Siggen.9999.6222.10653.elf	Get hash	malicious	Mirai	Browse	20.110.97.184
	SecuriteInfo.com.Linux.Siggen.9999.28313.2324.elf	Get hash	malicious	Mirai	Browse	20.54.143.248
	SecuriteInfo.com.Linux.Siggen.9999.29618.24208.elf	Get hash	malicious	Mirai	Browse	40.96.151.201
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	13.107.246.60
EDGECASTUS	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://spo.devgdmsuk.com/authorize	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/thaiphong.com.vn/.dev/4vGsuwWa/ZGFubnkubXdpc2VuZXphQGluaGFiaXQuY29t$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	http://flow-energy-3109.my.salesforce.com	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27
	SecuriteInfo.com.Trojan.GenericKD.73894233.21093.11208.exe	Get hash	malicious	Unknown	Browse	23.43.61.160 40.127.169.103 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.589554271604487
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afxb2iJikHB+EdrxszvB06shRIxaJkX5ocYwlRL/B0:Xq8NkC1fxb5JdBxCzvG6QI8JkKc97q
MD5:	D616EAB80FEFEC2459F15F0F9505EE33
SHA1:	A39C7C3AE9077135CF35E1EC67A7799005E700CB
SHA-256:	E5AA8AA13974E7946F7AB16910733074A6D58662D75E1B0070CC0B36200E6155
SHA-512:	9684114E220BC21F2687382CAF2F4882F0F42305150E6671CD26B1919209A4E68495C67B48BB726223E0054E114332A385855B33B93FC7218CDA0F7FF4048F3A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"policy":{"last_statistics_update":"13369563534315612"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2d83b2a4-1502-4278-aea1-a49d14a2667a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\30839638-9e16-494c-a3ac-118d59f3f82c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21000
Entropy (8bit):	6.065167506295352
Encrypted:	false
SSDEEP:	384:jtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSpXBGfKQmRT9ljFgJ:JMGQ7FCYXGIgtDAWtJ4n9xGfKXxw
MD5:	06820B1381DA9C49738ACF50D92BAB93
SHA1:	FCA8C6E62C40520991249375AA713497C636CE21
SHA-256:	121A6CE6A2B682A8E1C7E0F40D46C86AD27445421895C257B11850ADE24297D6
SHA-512:	67463BD663F8A377A087B4D2F9246FBF0E993588211A461E0FE677290D3D73237DBF94F39C44A07C037DBA739DC28BF42C1FDD0B2E579CC751C179F6C070D514
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\39f62be3-9e5e-4987-a312-a7a330447fe6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	5.496999147187612
Encrypted:	false
SSDEEP:	96:0q8NkGS1fxb5J58rh/cI9URoDoto2ZBxCzvG6t5UJkKcoSDS4S4SDSFugI4a:/8NBSvgeoDUVYn5EkKQw
MD5:	E113C1525839FB4F994AEB8CE6260D20
SHA1:	4DE35554BFA146C68E60095F0F747CB6FB101430
SHA-256:	488D6EFE224B069375ACFF44604BD67ADD11AAFF89F98291BE567E978C767BAC
SHA-512:	539E1C4D337D231D304DAA981497606EF2EE59F7D025246DEE384E75F4104A75A1B51F176FF57B5B26C470F8D14A1622694667FDA5FA68968EF6ACD86FFFE48C
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\56f494d8-22d8-465a-8efb-93d64f9bfb51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71026
Entropy (8bit):	6.072880217015353
Encrypted:	false
SSDEEP:	1536:JMGQ5XMBGwKK/DPWDf3i12TmgLFfq+ZytDpbjgvFM7IgDE2u:JMrJM8+/jWDf3iUmgLFCs0Fbjg9M7JDi
MD5:	446CC805F26FDF41B9C3EDEDC91BE26F
SHA1:	8042C8C56C91B6495BE6EE33A4B6952241A22982
SHA-256:	54BF7599C3E784F062B69348B99911B057E91964A18152B29A6A84FB9C6F3D10
SHA-512:	965868BCCD638F083F6F8453C6A3253B69F78795E90F10FBC9DD36FB73479DC7929FC031D4308A642B42D18666E4A968701436D6761C24122A91F1E215951B9C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6bd10108-e7c4-4b86-afb4-bf01cbbfe04a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.589554271604487
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afxb2iJikHB+EdrxszvB06shRIxaJkX5ocYwlRL/B0:Xq8NkC1fxb5JdBxCzvG6QI8JkKc97q
MD5:	D616EAB80FEFEC2459F15F0F9505EE33
SHA1:	A39C7C3AE9077135CF35E1EC67A7799005E700CB
SHA-256:	E5AA8AA13974E7946F7AB16910733074A6D58662D75E1B0070CC0B36200E6155
SHA-512:	9684114E220BC21F2687382CAF2F4882F0F42305150E6671CD26B1919209A4E68495C67B48BB726223E0054E114332A385855B33B93FC7218CDA0F7FF4048F3A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"policy":{"last_statistics_update":"13369563534315612"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6d42c5c4-0192-4a9e-a53f-be4a74eb420c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24352
Entropy (8bit):	6.05735910143027
Encrypted:	false
SSDEEP:	384:jtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGpPBRCqdqVEM7IgDE+RT9ljFgJ:JMGQ7FCYXGIgtDAWtJ4nLJR9M7IgDEWu
MD5:	05D789889BEA72333EFA92B9BA2286D3
SHA1:	D4DCA8D1F46E0F0736EE8395F170008466DC1DBF
SHA-256:	8683DFD34C25F148A2B01C67D135398FAF79B0E97750E5874C284EFB33BF8B11
SHA-512:	2A325748CFFD5BC5326A8AAF0EDDEE27C963893CA61FC36CA6F55D2EE6D0733EE94F3520415C06C9A88803423B5AC11411439BBFEECE818B1A2202BD41917DCD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\76da82d1-c9f3-403a-84e7-ae45d2d8b399.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21000
Entropy (8bit):	6.065180094784168
Encrypted:	false
SSDEEP:	384:jtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSpPBGfKQmRT9ljFgJ:JMGQ7FCYXGIgtDAWtJ4n9JGfKXxw
MD5:	AA3ACC7EAF179A61801E086E361BFFE4
SHA1:	09A59CCFCDBF320B829F4BA37C81E88ACC668ED6
SHA-256:	653F47F17BB04F357D459FF2F1B242C03A105AE9A017C89E7D36AE7E8A3F3077
SHA-512:	C5DB93C2C071C9737E307E941898C4F46D2B934724DF721B748269FA7A4CC8853FA6EB64AEF5C6A703A904675A9834CA08662EB85F16237C8800810303C85C5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\696e5b3b-3dfa-4dfe-b0ee-38ba5abcf67c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D2C88E-1BAC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049949752488827
Encrypted:	false
SSDEEP:	192:yJUjLYiVWK+ggCd1bJtD+1X9XK1oUgV8vYhanwNE1b8GRQMotRn8y08Tcm2RGOdB:0Ujjln68GnhrcdstR08T2RGOD
MD5:	BA86926966DB06F06139F8B666A35274
SHA1:	AABEC3399BF46EAB650A0A2967B8335A844A5A0F
SHA-256:	32498D4D2F0E69121326D069CA61EC0D83B0C9D432C6F971C92E95DFABA1E756
SHA-512:	FB32D69804278CD7FD420D604CA70290BBB28B4F924F3438993EB1E0E65B177F6F39E8C699E2B72BE809AF6406097ABCFF33AC7EAEEC0186A628E2CFE01448CB
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hbvxnm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................=..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...d;.O..,@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D2C88E-808.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4576071191401587
Encrypted:	false
SSDEEP:	3072:+zqU9N4DQr1NMDFMQZWPD3Fagf22UWdbwepKPUg1HFrTMtffxYiH3qkZ77rWfZzd:Gp4OwKKPUaH6Ci0t+1aH8nHBy
MD5:	AE44922880F03EC860D9F8E7492A40E9
SHA1:	5F6502503FE45A299703FD0CE0BB79D3D2C4222F
SHA-256:	9029281E924304DFC49226D7DD57E3FC25226F86937940F336D6ECBFA3B43EE9
SHA-512:	9319DFA0F5A3F172855886A23E757DB365D7AE0AC02F27CB3BC5763522A60844B97330476D1DD98FDE2EB78ED985ED50CDBD20FB45A74C0BE7C39AAFE91E5337
Malicious:	false
Preview:	...@..@...@.....C.].....@...............pS...R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".hbvxnm20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1544252163044275
Encrypted:	false
SSDEEP:	3:FiWWltlMobXfHSRqOFhJXI2EyBl+BVP/Sh/Jzv+dFDU+uqEIHlHXWWXl:o1MGXfyRqsx+BVsJDiFI+5h1WW1
MD5:	B0A5C6D15332C37FAC28B7F94CB84FE9
SHA1:	1823ECF6F1400C196093DB8CF87B71DB539DEF80
SHA-256:	873E89254F9094156B3717F26B6B34A238FF941B754F9C93D9C97FF12F712828
SHA-512:	56DA5625CE3B5DBDE10FEFBF5CE63DA3BACA23CCFE261B499BF57A89CC042233F7964179AECE5B22D2F57F7612C31DED9639E1E35B33B60A75A3DB9DA81608EA
Malicious:	false
Preview:	sdPC........................\..I.~=.R..."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7a54875a-f144-4684-928a-bef30bdb25f0............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\03381532-7c83-4e05-a2a2-86f9ea63e7df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.9816283325546005
Encrypted:	false
SSDEEP:	96:stXqfJis1gb995ZN8zDs85eh6Cb7/x+6MhmuecmAeo2QF2Mj/EJ:stXvsqZNkDs88bV+FiARPjMJ
MD5:	72678F24D0D965E060CD348D4A67E2A5
SHA1:	91BE213A3D9DB6BD5463580923CB153E9AD49F7A
SHA-256:	6A53ED172BE31710F117A3687825FDE8B2544FC7DE93A381814B7DB8CE8D22D6
SHA-512:	63C2F2D9439519C5E99729A009615A0C3F46FB5E51E8CDC6583E132E8CEEE5D47BD5C6E0B200F9D143C6B22E579130D83FD85A37091616E1AA975DA6C493A262
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369563536706303","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369563536705735"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\05a19891-82b5-4ba4-a560-9ea009670377.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.9794234720816055
Encrypted:	false
SSDEEP:	96:stXqfJis1gb995ZN8zDs85eh6Cb7/x+6MhmuecmAeovQF2Mj/EJ:stXvsqZNkDs88bV+FiACPjMJ
MD5:	6ED0FEF3CCF03350AD810055073DB548
SHA1:	4092A974F1F32E057618E2700E51D659E5FB1203
SHA-256:	9A1F8C3F1DF8DD547444754BB5F6CDF2FF460B117B47835A35A98B67A0ACA549
SHA-512:	FD8388693652F6A6FA69F85D5B277A10AE5005ACEAB66DC260D370A7090BEEE467CD8DDD6AB919CF861ED30740CDC904CDBF20B2ADD14C46513C312CCC3576E3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369563536706303","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369563536705735"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\16bb5a6f-b30d-4b76-ae45-8fa6299314d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972165714316245
Encrypted:	false
SSDEEP:	96:stXqfJis1gb995ZN8zDs85eh6Cb7/x+6MhmuecmAeoot2Mj/EJ:stXvsqZNkDs88bV+FiAUPjMJ
MD5:	844E44EFA74E33D07D7F96966454141E
SHA1:	3E13CE7972BE79DB6B44A579ABE2ED7D92FB6933
SHA-256:	E8B5DCBEC651111FA3613C11D4CCC55CBEF487BA1007F9E0F87D89C3CDFBA433
SHA-512:	90A23C2B7A53E3827A66726C17D86478D734B13366C3B0FEDD4CD29B258B4387317A1CD88A71B450536BFF91FD9B15D857027413C7EED053A681700F36FA36CA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369563536706303","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369563536705735"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\21172a48-76c4-4a07-a060-3140ad540644.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566249740124959
Encrypted:	false
SSDEEP:	768:K+VW92WPHjfLw+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUR/7drwmpGtuC:K+VW92WPHjfLw+lu1jaJ97mDtt
MD5:	A54347C646DA202A593DB97DEBFB1BD2
SHA1:	243BEB5B803616EFB814C0781D5E8263A390AFF1
SHA-256:	58E900465A75CEED5D024D84666695AA3388428CA19CE37A2DC58FAB91FAB299
SHA-512:	21F045E7A9E414D5BA766D6DE48B8D8479093E2863C9E310D0DDC9ED75E11DFFA9ACC30DB2DE6955C308D0F590029035D0C1C0796580FAD71660999FC87B0324
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563534958977","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563534958977","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8501e6a3-9684-4a62-bce0-d00a0cbeebdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3209778228345375
Encrypted:	false
SSDEEP:	192:0AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:HOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	8924823DC96D1BBDC7459E3DA66D69FE
SHA1:	7725AFB4B1E041333D25C2F1FE1B01489E2113D1
SHA-256:	C108A15D609314363C59C904BD7B32246E274EA0B312039BB09AB8B5862BA812
SHA-512:	1305934729196B3E30CFA50D49BD3540C9C311602DA7D433A670559A193B6BEC9FC11EDCEF345A9612AEE1E42D1820EAA97FE85A1CB84FBDB41EF252357AECB2
Malicious:	false
Preview:	...m.................DB_VERSION.1%..9.................QUERY_TIMESTAMP:arbitration_priority_list4...13369563539919656.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.166162921449685
Encrypted:	false
SSDEEP:	6:Za4jEB1wkn23oH+TcwtOEh1ZB2KLlTa4yVQ1L+q2Pwkn23oH+TcwtOEh1tIFUv:ZJnfYebOEh1ZFLxJy29+vYfYebOEh16g
MD5:	28A14B7B8332F23BD32085F0BADE51BF
SHA1:	9197A240509A5C254C042347E77716D586FD1A2B
SHA-256:	E71F5CBA60130FCBD7D206B6BA31CC695F985D1503DDCCF20B4EE2A160CA1780
SHA-512:	EFCBC13C155197573C7E5D63F55C4139E22C1652C5A3234254383572F9D140610D9BC5356AC3F80AAAA70FDCA2D2C87C6A08AC50F527777E95FD9E12E91DDE66
Malicious:	false
Preview:	2024/08/31-03:38:59.775 219c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-03:38:59.800 219c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.044568019774112795
Encrypted:	false
SSDEEP:	6:/Fii2a56B2M/lezHBFsB/EcRkMtYqWxYkllyc5/likS:dF6BTejcTkEYqqR/yczir
MD5:	9C044E1588A777EC6CBDC1AB167CC4FE
SHA1:	F65EB4D6CAC2695E1835B46DC01044831A779B03
SHA-256:	12F80669AFD64FD2B72DDC6857C8987C973CEEEF6E607092E833CEA235A90ECE
SHA-512:	7EE09E4E03E66C45B144A6C501243C176AE69D67D4B9D83727D425CD8460E6437A5C15B75D8F9AF15E9CC0E09F416A017784F39C76EC0CC7230BFE4DEE1594EF
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0957540067231109
Encrypted:	false
SSDEEP:	24:19V4XQ3eaPVHaUAPnQzLIoMBwq4Qzu/0V4XeaPVHaHVIRBNUeG9xlbZYT38EWp46:bV4A3esrAfnusV4Xes3NUeG9qT3lWp4
MD5:	49E72C4EA8D661B07056327720E1CD2C
SHA1:	AA0E4C8FA90F8C85CF22E55EC8CEEB3AD35D84CD
SHA-256:	299839A2C4FF2CC3C268BC9DFE4E5394C95BC870C4A2714D41E6C9ECD1756449
SHA-512:	BF65F1DF32480B3D6BC21D311D90FCC86D5DFA1B28E8D95181C0CAEDFD9577BF122544848AAA50B55893AF56B5F921E8AD8713197FE938D4FD9F9F07960D493F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2830931036783541
Encrypted:	false
SSDEEP:	384:DLEJtnxLEJtnwjx0Jtd4jx0JtdywhaAJtp:DAJtxAJti0Jtk0JtTvJt
MD5:	D48995F4F43704F4BA168A6592884A46
SHA1:	8053ABD9221365E0696F656D06F7A00B794909C3
SHA-256:	AEC510CF7F6484A1DCF8901F6375F0611EBCC3C1DBE602409ECA33DBE88E3676
SHA-512:	7543524876E70BD253C2730BA93552864133337DBFA9BB4D867FC376B5A3DF1F7A3529E4113E4806D923EBF6A9A9C4101D63308C65A7CD9B126E99FB4BB3D0A5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul4wp:Ls8
MD5:	9C92A0010D389542B0DAA59265CD7232
SHA1:	CCD5FB3211C27669512E067A00503F04E9A95035
SHA-256:	8952781FEFDF99B62DAA26A890679AA457B6E7D9EEDB3D0D4613D48704123041
SHA-512:	40DF5FF84A5453DE9D51201216B00117B0A908A10FF77CC8BF0AE6EF6408DA0455736449DC3F7CF847DA6F77CBB57727D22EC248B3565773F385E9294C87FB75
Malicious:	false
Preview:	..........................................t.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8981641637663254
Encrypted:	false
SSDEEP:	3:DYNEzk1el:E6zk16
MD5:	000CD20F825227E79E55EA060E8E9E9B
SHA1:	4F4255D04A44A1E826FB851375DA642D41F40F6D
SHA-256:	3A52CFCBF6D71E700962E89F9B59A6EB9425DDDF0B7ED55C8F5E7293FAE25DDE
SHA-512:	1D72D7CA2F81BDA29DBD47AC47AC85BC930E7AE43A8B150C8B1E9DEBF69F1D7E2A38A98DB380FFB8BF8892747DCA4E4509047292E1928239A0C0D61D8F847ADA
Malicious:	false
Preview:	(....=ewoy retne......................../.P.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8981641637663254
Encrypted:	false
SSDEEP:	3:DYNEzk1el:E6zk16
MD5:	000CD20F825227E79E55EA060E8E9E9B
SHA1:	4F4255D04A44A1E826FB851375DA642D41F40F6D
SHA-256:	3A52CFCBF6D71E700962E89F9B59A6EB9425DDDF0B7ED55C8F5E7293FAE25DDE
SHA-512:	1D72D7CA2F81BDA29DBD47AC47AC85BC930E7AE43A8B150C8B1E9DEBF69F1D7E2A38A98DB380FFB8BF8892747DCA4E4509047292E1928239A0C0D61D8F847ADA
Malicious:	false
Preview:	(....=ewoy retne......................../.P.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ooaaE7Mpa+:ooa17oT
MD5:	9E714B71061AD8E83619ECD87A0F6E91
SHA1:	398898F05CBE54DD95497DB54E508AFDB68AD163
SHA-256:	7DFCD192A31C3915F12C71DCD3918930A4AEB5DF630709AE3F269C9A70C72729
SHA-512:	78BC78F913136744D164CF42C5CE4547194B66E5D9CFB024CC8579A34C22E656D5FDBEA0CFA4A71CD94F9E975822A88B96D5611C6C216BE8DC57479150BEC147
Malicious:	false
Preview:	(...u\|..oy retne........................'.P.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ooaaE7Mpa+:ooa17oT
MD5:	9E714B71061AD8E83619ECD87A0F6E91
SHA1:	398898F05CBE54DD95497DB54E508AFDB68AD163
SHA-256:	7DFCD192A31C3915F12C71DCD3918930A4AEB5DF630709AE3F269C9A70C72729
SHA-512:	78BC78F913136744D164CF42C5CE4547194B66E5D9CFB024CC8579A34C22E656D5FDBEA0CFA4A71CD94F9E975822A88B96D5611C6C216BE8DC57479150BEC147
Malicious:	false
Preview:	(...u\|..oy retne........................'.P.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlZK/:Ls3ZK
MD5:	47ADF97081488C59AD99F5841B977537
SHA1:	977EC656523F3F4ECCACDBE55264939CA7BFDCFB
SHA-256:	34ABBEEFB206945199579D205EF3E5BEBC8280EF84E2E3803987B7A45DC9C595
SHA-512:	8D4FD04F9FAEAC822E43C46CB3135AFC2D634CB49B0C4E3EEF4D496723AF02584A12180E24C323F2E4849F29E0EB4A61CCD575B5DEF5BE3C639F963B05210B15
Malicious:	false
Preview:	.........................................zm.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354155979213612
Encrypted:	false
SSDEEP:	6144:lA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:lFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	006BDFDC9EA121905B572F9EB910FD30
SHA1:	8056FC9877C95FE93D1A3D447CECAEFF7A10018A
SHA-256:	B31B22021E4A7F14F21AD014F0139862EF229A2C88529870479677BE2D347D9F
SHA-512:	0A13DE2A30282D87240A3724F8243D0E330418D5B4F504BF07E0D6DF4E0CEC29DD1B3353F7A51B8C46752CCEE21EFF16130CD058F068A7A2F87847BBF43A5171
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13369563540582849..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.238621641141725
Encrypted:	false
SSDEEP:	6:Za4Yu1wkn23oH+Tcwtj2WwnvB2KLlTa4eS3+q2Pwkn23oH+Tcwtj2WwnvIFUv:ZJY5fYebjxwnvFLxJ6vYfYebjxwnQFUv
MD5:	69B33E67AC63C48E9377081C511163DE
SHA1:	3AC2B6C897178E79CF0F46B5B2B1EDAD33894460
SHA-256:	9FE5FC21AAD278CABD25D0A7367A9AEFF8F812038FEACF789ADBA1A248684C02
SHA-512:	C2C64469D5132735C904E7F2464B14524FF0D637EBB6148331C09464DB67D94ED3A11A176A523B284922DFFD49E5B69D22B2B0C914DBD2891B3448A825AED231
Malicious:	false
Preview:	2024/08/31-03:38:59.750 21b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-03:38:59.905 21b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324615248183906
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rr:C1gAg1zfvD
MD5:	FF50DC3334FAA63F87AED99317DDBB7A
SHA1:	283260E77D4A88959134996022148C90E33BE056
SHA-256:	543C991BF668BDC0EADCD68301E6C2C1DC48F4556A38EE752A04AF460E17945E
SHA-512:	90ABE2BCDC71D051BD9F883F3966F3721DF7EFFC5D3FB5C893D58EFA339E5731F0104AC604012994F9D127C105E71C7D53A18FBED05100CCD4D99DED46D19545
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.211446422086117
Encrypted:	false
SSDEEP:	6:Za4/FTq1wkn23oH+TcwttaVdg2KLlTa4InwFlL+q2Pwkn23oH+TcwttaPrqIFUv:ZJNZfYebDLxJMwlyvYfYeb83FUv
MD5:	6E5A19002EEA7BCD399353A716105DF1
SHA1:	B474B4402D01FE03855EA352E298289EC34D1C0F
SHA-256:	4DD481E3570AAA8490C0D6D56BC8E7B8BB71A18B84D18AF920050AE719906D39
SHA-512:	D1D84684D55D1E6BDCE8930AC56F7DC90ADA0B3CCB831E0BE6F046B5785AB28D5ABDF0F710EF52490073AC2B13EAE2817DE756A58F3C417E11ACF9D2D176CBB4
Malicious:	false
Preview:	2024/08/31-03:38:55.139 1c38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-03:38:55.271 1c38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.20366293144196
Encrypted:	false
SSDEEP:	6:Za4I8q1wkn23oH+Tcwtt6FB2KLlTa4IfL+q2Pwkn23oH+Tcwtt65IFUv:ZJ1fYeb8FFLxJOyvYfYeb8WFUv
MD5:	8C62200018B03C29442706F17CB3358A
SHA1:	26155A2A4B67354DABE13C46001914C6C9E78858
SHA-256:	CB280086CE57D405C6297CF9DE8FD2CF116C01C0AADECC8CB84541F2BD49BDE4
SHA-512:	3A15827B90B593CFABE97440A1191F4D1135AC88CE5E76270283B1DACE35F11098B875B77554D6AC818A31FF88238D17A079AC1414F6DB565EBDE3C603A66C41
Malicious:	false
Preview:	2024/08/31-03:38:55.274 1c38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-03:38:55.289 1c38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.212870509212514
Encrypted:	false
SSDEEP:	6:Za4HaFD1wkn23oH+TcwttYg2KLlTa4HmBSN+q2Pwkn23oH+TcwttNIFUv:ZJ60fYebJLxJV+vYfYeb0FUv
MD5:	192EE94E9768116A383D1899B2EC95AE
SHA1:	77A1228535EF279EF59232F293F3BBD6C213B32D
SHA-256:	7E109DD3D53F6B53D2595A7DF104F5A175A1A6D754CDE38D9504EEF4D7B6EA1D
SHA-512:	529E0A27009767EBBE2A1F12E2794500BEC84474DBDBEC5046CCE6D4DF2A0017A08515B79D8B03A44435C18815D7CB8EEF96E0E64DCD73A8CB6D7A6BBEB774AE
Malicious:	false
Preview:	2024/08/31-03:38:56.916 1bec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-03:38:56.926 1bec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlv:Ls3
MD5:	52658782253F37A1906D11E65892FC64
SHA1:	971C4147B4907AC9394F52B70748BDBC625E8333
SHA-256:	1E68A2EAC860C538A0AFF21CB7EF8D2C5D9A04CAE71355E0C76042ECE0A22B88
SHA-512:	82D851621B80110D6F757D0E497ED5D79DC68BDBF45771C14C3CCACBF7869044AF4BA282996160BD3D8303028C2D3E16EB013737FF7726DBA8AA9692A78E55B4
Malicious:	false
Preview:	..........................................m.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:cS7tFlljq7A/mhWJFuQ3yy7IOWUV6SQdweytllrE9SFcTp4AGbNCV9RUI0:cp75fO/3Qd0Xi99pEYG
MD5:	BB56B97D32F1710AD965AE0BF85732A5
SHA1:	2808AEAB52F4124E7EACC8201B72651D39508A14
SHA-256:	31BF992E12ECF68D69E2655E92B0DFD472F855A79F0557E759C9DBF06F0DD8D9
SHA-512:	F645E63D870FF5722926E03E625EC7F8664D418F434F31E7593516A17B5FEDA203F215CC10BC51BD1AFB153572EA9246B26F420963D0A1A15935E22B2A50804D
Malicious:	false
Preview:	............0.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.232847063706015
Encrypted:	false
SSDEEP:	6:Za4m3B1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlTa4fqM+q2Pwkn23oH+TcwtRz:ZJm3kfYebRrcHEZrEkVLxJfqM+vYfYep
MD5:	7236F8A8AD88B5E251BC7C527AED5398
SHA1:	0591EC5BCEF3330F17045A39778D42FF0DD8EB4F
SHA-256:	B81422E565CABF2B24ADB0986E628AA57D700C6F1C2414E4653CFF77034C549D
SHA-512:	65F868C6342D0CF4E78D60D0048AAEBDA99A97F893ACCF0602FBAC4520110A4FFBC3EE3A1448168607D4DD5A1815CCE30A2F1C348AED2E6BAE440D2419A6D515
Malicious:	false
Preview:	2024/08/31-03:38:57.811 1bfc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-03:38:57.823 1bfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.2243493751910535
Encrypted:	false
SSDEEP:	6:Za49cXhq1wkn23oH+TcwtRa2jM8B2KLlTa4HIRFZ+q2Pwkn23oH+TcwtRa2jMGIg:ZJ90fYebRjFLxJoRqvYfYebREFUv
MD5:	DC7F3F5D8DFF4BA2A7497025F5C11F42
SHA1:	77A338AB230BA76269B0E3E60315A776F6AE1FB0
SHA-256:	BFDEF97065DC30EE2E1527DF5565EF1CCFADBBE05D63FE05C3A1660670BB79C8
SHA-512:	35BFB9A84A3ECB020A08773FFC5685D74A3B69CA663BED3550084B71242BB0604C46D14C8F072E21825C7082259BC02CBAC12BD1D55EE968D5A97BD0F88F9527
Malicious:	false
Preview:	2024/08/31-03:38:55.515 1d38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-03:38:56.584 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\0615eeda-fd8e-42ed-b5c4-2f8a1a6addeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\61fdc26a-b962-49e2-836b-dcb79a4a273b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b660.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7606394355336457
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkOj:uIEumQv8m1ccnvS6Nv
MD5:	28E99688E7E6ADAB95794AA14ECFCADE
SHA1:	DDE8AE5902E1C950499E1BC52AB3A6F33C3D20B2
SHA-256:	D888A66D26E728064DBE056B43DCC442F899C8ED168710DE812C9C4195AF87AC
SHA-512:	C894B355C38487C9ED986FC843005E4FAE66CB2DC6C279A6E42746E6CEC8192427F19844B764DC33EB0BDEA0F5F61B54A2A6637E9AFC2E0FFCE70D2D00409400
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF293ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\dc86d1af-3599-4cac-9b17-4fa3c5086e63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e18ff6d4-3a20-461d-883b-764ea4a7b851.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e247d00c-3dd4-4774-bf4e-1b5924abaa90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972165714316245
Encrypted:	false
SSDEEP:	96:stXqfJis1gb995ZN8zDs85eh6Cb7/x+6MhmuecmAeoot2Mj/EJ:stXvsqZNkDs88bV+FiAUPjMJ
MD5:	844E44EFA74E33D07D7F96966454141E
SHA1:	3E13CE7972BE79DB6B44A579ABE2ED7D92FB6933
SHA-256:	E8B5DCBEC651111FA3613C11D4CCC55CBEF487BA1007F9E0F87D89C3CDFBA433
SHA-512:	90A23C2B7A53E3827A66726C17D86478D734B13366C3B0FEDD4CD29B258B4387317A1CD88A71B450536BFF91FD9B15D857027413C7EED053A681700F36FA36CA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369563536706303","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369563536705735"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32329.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972165714316245
Encrypted:	false
SSDEEP:	96:stXqfJis1gb995ZN8zDs85eh6Cb7/x+6MhmuecmAeoot2Mj/EJ:stXvsqZNkDs88bV+FiAUPjMJ
MD5:	844E44EFA74E33D07D7F96966454141E
SHA1:	3E13CE7972BE79DB6B44A579ABE2ED7D92FB6933
SHA-256:	E8B5DCBEC651111FA3613C11D4CCC55CBEF487BA1007F9E0F87D89C3CDFBA433
SHA-512:	90A23C2B7A53E3827A66726C17D86478D734B13366C3B0FEDD4CD29B258B4387317A1CD88A71B450536BFF91FD9B15D857027413C7EED053A681700F36FA36CA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369563536706303","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369563536705735"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39869.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972165714316245
Encrypted:	false
SSDEEP:	96:stXqfJis1gb995ZN8zDs85eh6Cb7/x+6MhmuecmAeoot2Mj/EJ:stXvsqZNkDs88bV+FiAUPjMJ
MD5:	844E44EFA74E33D07D7F96966454141E
SHA1:	3E13CE7972BE79DB6B44A579ABE2ED7D92FB6933
SHA-256:	E8B5DCBEC651111FA3613C11D4CCC55CBEF487BA1007F9E0F87D89C3CDFBA433
SHA-512:	90A23C2B7A53E3827A66726C17D86478D734B13366C3B0FEDD4CD29B258B4387317A1CD88A71B450536BFF91FD9B15D857027413C7EED053A681700F36FA36CA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369563536706303","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369563536705735"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566409123768859
Encrypted:	false
SSDEEP:	768:K+VW92WPHjf4w+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUR/7drwSpGtuN:K+VW92WPHjf4w+lu1jaJ97mfty
MD5:	741AF2620CD310C253D94C3199D8ECA9
SHA1:	FBEB49DC0591ECCAAAE5DC75543B4707CF07C507
SHA-256:	942D68B39B10F71227EDB59AF53781B3F2A84A63E396DF85AC6C60EDC462710C
SHA-512:	C68F194923F0F399C61FD9360BA8DC1882AD7DF3110098CBD836ADE7209FE42D1EF0CB2336394554860962AB7E4F23A0464A90C5F95851F409B04637E0752739
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563534958977","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563534958977","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f33f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566409123768859
Encrypted:	false
SSDEEP:	768:K+VW92WPHjf4w+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUR/7drwSpGtuN:K+VW92WPHjf4w+lu1jaJ97mfty
MD5:	741AF2620CD310C253D94C3199D8ECA9
SHA1:	FBEB49DC0591ECCAAAE5DC75543B4707CF07C507
SHA-256:	942D68B39B10F71227EDB59AF53781B3F2A84A63E396DF85AC6C60EDC462710C
SHA-512:	C68F194923F0F399C61FD9360BA8DC1882AD7DF3110098CBD836ADE7209FE42D1EF0CB2336394554860962AB7E4F23A0464A90C5F95851F409B04637E0752739
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563534958977","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563534958977","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.183966343253604
Encrypted:	false
SSDEEP:	6:ZQXhq1wkn23oH+TcwtSQM72KLlTcZ+q2Pwkn23oH+TcwtSQMxIFUv:ZgfYeb0Lx7vYfYebrFUv
MD5:	B239D9E6898CB0F9F05B0F4405B1A09E
SHA1:	5493B2A0E424AC25B55D178CA441685FAB46C141
SHA-256:	35F3BAA7EBA7AFD1A0944BA52A08AB05AB61CCC7C64EF28BFFEB46E1B6050371
SHA-512:	0EE59E886029E557596BDBE0842CCDE01CA2F7F631C2D6D2501C12BD9A23AAEC50B75B56A368953E4BE12CBC3A9B45F8A2F65C0AF6B35B89C4E254816D08CD75
Malicious:	false
Preview:	2024/08/31-03:39:12.652 1d38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-03:39:12.673 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.124479052381524
Encrypted:	false
SSDEEP:	6:Za4ts81wkn23oH+TcwtgUh2gr52KLlTa4IPJWvIq2Pwkn23oH+TcwtgUh2ghZIF2:ZJtkfYeb3hHJLxJ4J2IvYfYeb3hHh2F2
MD5:	EF4E8E8E00260FE2717828824C66C96C
SHA1:	7DE48682FE96C95DD1D156A86B1C577F9ED64967
SHA-256:	3AA50003448594502DF81803EE463383DB2294F608916684FEF46D47B88DEF58
SHA-512:	C9509A834A11D8FCC2E6C57A6AF172BBA28745E460899409D0481426CF5448F8E15A0FA5DF407DCAEF3D9596DB278BB3A314CAF36A00991BD43DBB0A7B9BE476
Malicious:	false
Preview:	2024/08/31-03:38:54.995 1c30 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-03:38:55.213 1c30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulycB:LsqB
MD5:	A64F123FDA3BBB124C80471817FD5848
SHA1:	51C558A1CEB0502006D417D818C708E1252B6F26
SHA-256:	0D70CAA1251506E16BEC7B7D2673FA0E1B7705E5756150AED06C84242CF3769E
SHA-512:	E38582FAAFD4AA28BBA3AAD79025972250ACF1270F3E4DFF005097864C217EA15B36D1300A353C01A85FCB482B443EC82CF1F0E5E39E9CACC2BA7BAAFF7AD09D
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:6g6K0E0E4sfpBln:6M/
MD5:	5128F78CAE1B47ABD08024A5A52DE56E
SHA1:	AAB2638E4B4C972AC907EA728DF35BC9FB03E8CA
SHA-256:	FEFC0E21BD01E3EB03CA297DD4697A76B67AE99899B1F24DD874EEC2751CBE2A
SHA-512:	9C43A7BEC0B22940D65870401EB4A75BCBD16E7449580880482BAD95DB82AA25F4DC0051FFEFCEB580A316DB0C16C6482491F3FA62F32FA8E5AA234EE2B8ECBB
Malicious:	false
Preview:	(...'..oy retne........................d.k.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:6g6K0E0E4sfpBln:6M/
MD5:	5128F78CAE1B47ABD08024A5A52DE56E
SHA1:	AAB2638E4B4C972AC907EA728DF35BC9FB03E8CA
SHA-256:	FEFC0E21BD01E3EB03CA297DD4697A76B67AE99899B1F24DD874EEC2751CBE2A
SHA-512:	9C43A7BEC0B22940D65870401EB4A75BCBD16E7449580880482BAD95DB82AA25F4DC0051FFEFCEB580A316DB0C16C6482491F3FA62F32FA8E5AA234EE2B8ECBB
Malicious:	false
Preview:	(...'..oy retne........................d.k.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:NJ3KcFQyEvga+:by9vf+
MD5:	59DE517A240BFE901BE5B87F94CAD6E5
SHA1:	949A8C1DE9B0FEAC948834F22BF29FB324435E3B
SHA-256:	DEEE0385264C042D4FFC85CE950FA402BC904EA1E7AB28E2A2FAD60400D51825
SHA-512:	DED5500A0D35EB5D51D43762C29E7DB603858BC3AC3BA2920655E214526845483AD9A969AA6B77234EFA683371E7B6A1FDFA033632C12F2A335C6F3D95F8D987
Malicious:	false
Preview:	(....l#.oy retne........................3%k.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:NJ3KcFQyEvga+:by9vf+
MD5:	59DE517A240BFE901BE5B87F94CAD6E5
SHA1:	949A8C1DE9B0FEAC948834F22BF29FB324435E3B
SHA-256:	DEEE0385264C042D4FFC85CE950FA402BC904EA1E7AB28E2A2FAD60400D51825
SHA-512:	DED5500A0D35EB5D51D43762C29E7DB603858BC3AC3BA2920655E214526845483AD9A969AA6B77234EFA683371E7B6A1FDFA033632C12F2A335C6F3D95F8D987
Malicious:	false
Preview:	(....l#.oy retne........................3%k.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl1:Ls3
MD5:	1392A167F497A475E18AEFFCE33D4A02
SHA1:	85607866CBC3702AAFD2EB1BFE0B7FC4577AFFB0
SHA-256:	2D633BD4F212E31AAD0BA77EFC5B04FDB99E5EBC40B7701F7730C286414C7A7F
SHA-512:	586373B23A26EFA51B4D9186904D76FBD542C1397FF1C05840E04CC7545C631B90AD90ACBA7F58B3BA072084D6D6FF4BA8556ABDFFF0D3FE16CC0AB29DA5B2DA
Malicious:	false
Preview:	........................................y.o.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlbaKll:Ls3++
MD5:	78BA7B7E1A1E01BE190942F4AF78B3A6
SHA1:	46DBFA796A11B2CBF87538507879EA06AB2D19F6
SHA-256:	F852262EAA9A6CD22BC1472782D34286C4B363415EFBCD8A65B8107692F5C7F3
SHA-512:	7418C5EE637F97551F767BAEADFE80C09E9CA75399BE61B3BB68B9547174EB847027FB2430B0F1EFDFAC84CEE9B690E814A52FF5EE9137AD538999502FB58BBB
Malicious:	false
Preview:	..........................................n.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.255901897373538
Encrypted:	false
SSDEEP:	6:Za4HmEXhq1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlTa4qZ+q2Pwkn23oH+Tcwt0jU:ZJdfYebqqBvFLxJRvYfYebqqBQFUv
MD5:	B14C8412A651B237702999E9004BA900
SHA1:	99EFF3D648F7DEA507925F4EC4456E9837B1F866
SHA-256:	7AF6FBFD36537C06202555A7B61F88D75D7DA7EF84A76C6D9D8AFF2E6610532C
SHA-512:	63D4B550ED3C2F60E8F4AB23FAC9F265CADE0634BF81C7D31495279BE445A960EDF28FE582B222CAE750EFE0BA4B6F3D4A10C272260A54269CA2947A84E83338
Malicious:	false
Preview:	2024/08/31-03:38:56.926 1d38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-03:38:57.204 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\236b4e4f-9366-4027-b472-d5940c37387c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6932fd1f-68a7-4aee-a219-d00e05e012be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b6af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d6d11d11-f072-421c-b6d0-0b44c1d7421c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fe50d899-9393-4419-acde-8f6674c5ec9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.2214347520334625
Encrypted:	false
SSDEEP:	6:ZdOJXhq1wkn23oH+Tcwt0jqEKj0QM72KLlTt7t+q2Pwkn23oH+Tcwt0jqEKj0QMH:ZdYfYebqqB6Lxt7ovYfYebqqBZFUv
MD5:	592912E53601142FA456A1C3F84653A5
SHA1:	A9B60C36CF4409C2B469E33DA6D2B0B7B3B4B5D8
SHA-256:	080281185D627ED80A9623C2A30EC1D335E4C25F7662ECD5236A8AB879E27169
SHA-512:	CD626D12990DEFFD86E3E66A3B218697EDC41B05C05157496B4D7D7E608700171AE43DAFB1CD1A6BD6C84EBDA8694C2721DAE8E034C0B9321CE2D4211D5BCDF5
Malicious:	false
Preview:	2024/08/31-03:39:12.719 1d38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-03:39:12.744 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.240319339104138
Encrypted:	false
SSDEEP:	6:Za4t0sB1wkn23oH+Tcwtkx2KLlTa43FOSQ+q2Pwkn23oH+TcwtCIFUv:ZJt0HfYebkVLxJ1a+vYfYebLFUv
MD5:	61006CCED6959DE11F6F63D4142FB6E6
SHA1:	4AE26D4D801F0CD88939966FBCAE9C0E5A6285BC
SHA-256:	5B68FE436830DE996B0596055C38F404BAAA4CED3AAB444FCE35271258288816
SHA-512:	5409C4AA8223447F5E23695EC345AC2025F2E4DCD3A2CAAE72857F2416F14098FF0C9C765EF3931B08E1DCC3C577D27B36E98B8F055B597AF8A427D2B7762C6F
Malicious:	false
Preview:	2024/08/31-03:38:54.962 1c2c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-03:38:55.131 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVsGXdlll:IiVsGN
MD5:	BF7EAECCFBF5780AF1331635E7492B90
SHA1:	B9B9CC35309EB6D3B6B1FFF3B4DA8D30289EEE6D
SHA-256:	E220E09CE13B964485C0B0FA865F7AB8D7EA8EB17432A7D5430D7CE298B9BC79
SHA-512:	DFA59D90CDFC614CA525EFA27CAC7501BD5A1EA49AF79F199AF587F9A823386FAA02D2EDCD14AC408C99DA8C75956B4C3C2D37D44F3344108658F53F242531AB
Malicious:	false
Preview:	VLnk.....?......r...^v.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0769635478683652
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOKSAE+WslKOMq+vVumYCvn66:e/2qOB1nxCkOKSAELyKOMq+vVum9p
MD5:	4DFC480A13ED99E1A72D57B2BE5CC014
SHA1:	CC8307BCD9F08D22635099FA885F6B6694D6BE5E
SHA-256:	FB737909B39BE9D90140761CB55B28247140D59A107A46ED6A64036D7FC85054
SHA-512:	EFA456D8FAD378572CDC3EC94F7E5FDAACB71D4AB7607AB323B62A1F75D6055AA4EE177C37493C065BCD04C880FA03C24E81F41CDEA62042324F3C4E6D3BFE8E
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\a212f7f1-33ee-48c2-ad87-158cf28c9c1b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566409123768859
Encrypted:	false
SSDEEP:	768:K+VW92WPHjf4w+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUR/7drwSpGtuN:K+VW92WPHjf4w+lu1jaJ97mfty
MD5:	741AF2620CD310C253D94C3199D8ECA9
SHA1:	FBEB49DC0591ECCAAAE5DC75543B4707CF07C507
SHA-256:	942D68B39B10F71227EDB59AF53781B3F2A84A63E396DF85AC6C60EDC462710C
SHA-512:	C68F194923F0F399C61FD9360BA8DC1882AD7DF3110098CBD836ADE7209FE42D1EF0CB2336394554860962AB7E4F23A0464A90C5F95851F409B04637E0752739
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563534958977","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563534958977","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\bfcc5d73-b309-4477-a7d1-0e6a12bc125d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/k/1FlFll:7+/l/
MD5:	E84E52D57013F7C05B16A78652F02A9D
SHA1:	5187100E9A8B1B171E95BC3C6D1D9ECD0D4F00CD
SHA-256:	D095BF7BC4F350398C0C9CFA672946F2199B9ADE32CCF9D68C73151CFDF36DC8
SHA-512:	53936A7EC207F35E7156206D978B3E58BA7D011480FC2711FA37B5046E8A7909AA850946586AAF678AAAC5B1791A444571E8AEAFEA145F4CB43FD4003D7B416E
Malicious:	false
Preview:	.... .c......c5:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.050021942291891254
Encrypted:	false
SSDEEP:	6:GLW0S3W0SBL9X8hslotGLNl0ml/XoQDeX:aYWGEjVl/XoQ
MD5:	BA8F2FC6CFC68A14ABD557B265032CA6
SHA1:	02A426D475FE4D74F5B470B694AE3269939A6D95
SHA-256:	ADF94FE342EB7BA89B15E319060343C95D401B80BA636016E7197D4770702C27
SHA-512:	B0638BD096B13A97C37E3F6D94E6CE5E3CD636FB52CAE6D89701A9100AE5FB0DB8CE1B75A3C7EE7878A2D219C7926AE16F78F4FE0A0AD146B566491DD1EEAD67
Malicious:	false
Preview:	..-.....................3x.F.......0......5..uv..-.....................3x.F.......0......5..uv........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9990366912201447
Encrypted:	false
SSDEEP:	48:ZzxYYlO+WcbX+Fn9VAKAFXX+//G2VAKAFXX+QyxOqVAKAFXX+jnUYVAKAFXX+pnc:tx7AmNsiNsLO5NsiNspc
MD5:	6EEAA01F1B34CCAB2A2BF583027227E0
SHA1:	428ABFF93C65C9615BDBBB71696209BE4F99C021
SHA-256:	8587E6AAEC6CE173DAC0B8A006A2463DCB2B7791592B4E107A6C6AD788A39138
SHA-512:	8A9D3AD522A13CDFB706A64B5CD7A24DA31389D8C237BDCAF358A3037F91AAF19606E834CD0046727231D90D870E5C3B0E3D80F62A87774009E331172249FD3F
Malicious:	false
Preview:	7....-.............0.......ro.Y...........0...v......SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.4831803348235635
Encrypted:	false
SSDEEP:	48:gh8SSBStVgQAPkuHRHXxtIYjIYzzVFqk2MYjMYjyMAlkfAlk43c:V0t+QzkIYjIYzzjb2MYjMYFYcY93c
MD5:	0DD80F1932A030F041CF985AE66BD56D
SHA1:	3C04DEBD4BAEFAF3EEA437976DAD34A179B3BA2C
SHA-256:	3C02632A7610C7E100576EC4BC5A5AB3A21C1A47A5A0F1812BA2896CE43C2E57
SHA-512:	D8E160F9D9CD140FA55CF5DC8676FD074413B990A3689C8CB3F187FD42B104689753EB5E56ED5B3AC647F76E604A8AA646B4676A63BDA8B6DACE608ED167CCA9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............Cc.T.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFe

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.30520603696433
Encrypted:	false
SSDEEP:	6:Za4HgF1wkn23oH+Tcwt0rl2KLlTa4HsUN+q2Pwkn23oH+Tcwt0rK+IFUv:ZJtfYebeLxJMNvYfYeb13FUv
MD5:	FDD67DD2702DFF0DAF5EE4C3AA8E2E10
SHA1:	092368EDD97CB9D6211765867375CF172082D940
SHA-256:	F7127947A8915E8B82337620EB8ED13BBA62E71596D6893C627554903E93D895
SHA-512:	597D48674C1E9133194B91F9E54B7201C8E25AE03DFAFF3284A468ACC404089F28432B4DC37D3914C9A6806085E286A79345FFB138A36A2D343F9946E08A2F7A
Malicious:	false
Preview:	2024/08/31-03:38:56.979 1c28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-03:38:56.987 1c28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.9627159252735735
Encrypted:	false
SSDEEP:	12:G0nYEQeeetU3p/Wui+it/Fql3RmPStub/RG0lbANqa:G0nYEQR3RXiyl3Ec25m
MD5:	1513C3C368DB88478835B37AE8AD65A2
SHA1:	0F4AD6BEF5A03A043FD245424FC0002486D9AE0D
SHA-256:	492D5C50ED08F797ABA0A73C64CFA4977413E73011605A0DDB4657781550A06D
SHA-512:	A2D4D85A2A56DAD888CE7AE34675D508EA8E55CD6680D7C22950D50D593F7AE88FCF227CED4A0C40212E9225A72CE73430406CADEFB914F0A33C4D61DD921592
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... ..'i..................21_.....B....................33_......-.t.................21_......'..................33_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....Owa..................20_.......K..................39_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.257617486989347
Encrypted:	false
SSDEEP:	6:Za4HmHfz1wkn23oH+Tcwt0rzs52KLlTa4Hu5N+q2Pwkn23oH+Tcwt0rzAdIFUv:ZJefifYeb99LxJOKvYfYebyFUv
MD5:	194F6F831B11A17F00CF00115420DA56
SHA1:	4B3D94CC9D9910A9337EB621B69EC3846290965C
SHA-256:	99E36FEF7B4EA0AC250B9FDF9FAA14AF8BDA46CBDD341AED60EC99DA867A1824
SHA-512:	86D1738544CC7FA24D345218AA08ECA0E219BFAEB1427620E3803D3FEC8E9C37E06C9311E4E6F8D7CC9C59DFD15801E941E112B5C5661A999110F60449406B38
Malicious:	false
Preview:	2024/08/31-03:38:56.708 1c28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-03:38:56.977 1c28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNllw0:Ls3lw0
MD5:	9D55CD4E582C6FE69DC8AC91C4652F92
SHA1:	396ED5CC492E509B639518C12A6AC2848197D5BA
SHA-256:	5DC9F2B8965DE05FF0694467D198DB8EF0EDC46D380AC6307310119A66DF6A70
SHA-512:	40F772EB742EAEF3AB74C95627FBCBCB24FF3EAA7A6703AFE780038FE60195D631423B32C874AE3B0F9E15F4A70CC3C55009526DFEA2982FF605E5C60B827CD0
Malicious:	false
Preview:	..........................................i.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYI/:Ls3Y
MD5:	412B04392E6425E80C8495EF8D8CB288
SHA1:	A04352129B60E79F8929DDD5DFA4996DF582A5B6
SHA-256:	8FD7EAFFA2DF645A3A27F1CF90D13267EC202351FDA463DDF54C5C70AB7B57A3
SHA-512:	101502D44540F38B2F24FEB0CA9274431FE47D726AE5DF648026A214AE7E01AFF416AC6050509844CD90ADC71AA8FD7A569417A0E1DD085EBEA38AFBD8015807
Malicious:	false
Preview:	..........................................l.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28553.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28562.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF287e3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28821.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2aea5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2d799.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3188a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF349cc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3712a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39849.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3f85b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.539275125221065
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrta+9/RwjY26DflZ2EyikePToJdXBuBuwB0a5kmNhlvX+XeKRax:YuBqDPafxb2i5igBzB067l25pB0
MD5:	E8E06C95736945BA1991F6CDF7D367FB
SHA1:	4E861E52635732C8031505222B6E89CD920F76A6
SHA-256:	B45B831DE2B4396EA5FFD4D20268A441B8CF1C6A4C6AAF0CF700F22A0E75FE9C
SHA-512:	089A39F5EE2801703383CBE7DD2DDAE79DD41C1675022FB8B862D17F81B461C410139A95B2EF749168CC0E4ECCCC488B890F2C4B6B797A066CAF3B8D22114D40
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369563534272607","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725089934"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNls6:Ls3s6
MD5:	AA90123F95D39734B9D06F157464D9F7
SHA1:	AD2AC5819748B1FCE21E4D67FC8368FA5CA243BF
SHA-256:	E5FECDAED639591ED2EA8AE5B448F2A36F499C575E75B9CEA97ACA4AE7CFCEF8
SHA-512:	AA9948B72CF709DCD853F58E95BCCE9D8B437E7E36B14B2945DE8302CAE080D6298A54A8FEFB43DBA0CE7836D293EA6D637961DF3F9E01C24CBAEDA78A47932B
Malicious:	false
Preview:	..........................................D.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\a22b82f1-81cb-4c08-951a-45cd27f0d285.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21000
Entropy (8bit):	6.06517052631377
Encrypted:	false
SSDEEP:	384:jtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSpLBGfKQmRT9ljFgJ:JMGQ7FCYXGIgtDAWtJ4n99GfKXxw
MD5:	2D221AB73288929F1BD8C6ECD2428CAE
SHA1:	65238D6C952D520A36153FAD84DF587F24EF65F2
SHA-256:	D1EBB5333CDCDB9B03465F2FF7029DD0E2418F20E04DD0BC493FF81A03290C8C
SHA-512:	D9EAB6514D13EE856193969FBEA1328201EBAF9A0ADC1225DAC16E7AD543554EB47AD09678451D44A434F84173E27343F2999897497409C8D8643BCDFB36789C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b8ea0ccf-495f-4980-8267-58331ae4b422.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3334
Entropy (8bit):	5.612000288290559
Encrypted:	false
SSDEEP:	96:0q8NkC1fxb5JR/BxCzvG6t5UJkKcoSDS4S4SDSFugI4a:/8NbvfYn5EkKQw
MD5:	5AC2D8EF35D251F727AB1CEF0F93F186
SHA1:	7212FEE040AE9D5404A9363D81834DDBDD39876B
SHA-256:	19625C8CFA28400302D134FA18EEA95CFF0F8B550FF8F313C67C2D42C783FA93
SHA-512:	32291297D62027877A34494A5357CBA97464D68D411DF1D435F058B930E7645567A276012BFB276454165AF57DB18868F15D9E0B191BCEE01A2AD30C5FF5D7C1
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA4sNhnWrLFECMfWj5nSjqEi09BmFfESYrNDr8Ju/5aFgAAAAAOgAAAAAIAACAAAABNRmWkClC5YoGjZ5fcUMdF1PG9h6xk8Rjbebx+Eb4deTAAAADrntOFWzQR+NGnaD65crt+CQfmQc+DyMCYG1ubZeUlYit8j6uVuxcSRnQoEG+esgxAAAAAuZyq1QuMj0T4cPC5i+JchuVqYh/zYV5qqNBNNJK3Al5COJWeHmkLXbhgxZeCtCnMIdzlrrRp8GQO7LZIoy1Yjg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\bb7b52dc-2968-4cc4-8dbc-d182333dfb7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71065
Entropy (8bit):	6.072952346868309
Encrypted:	false
SSDEEP:	1536:JMGQ5XMBGbKK/DPWDf3i12TmgLFfq+ZytDpbjgvFM7IgDE2u:JMrJM8X/jWDf3iUmgLFCs0Fbjg9M7JDi
MD5:	2891F931C9738E335397084C522B1A25
SHA1:	9E1D4FF3D68D694139714667645A64902C4331A6
SHA-256:	419297980808816EA36ACD0A6535597C77E6550ED40C8C5A4AA93C4D9460247E
SHA-512:	A0491B1786B9B55AEDDD810A5491EE85C0744992D0BF2F49DAC8832643EA0370957198D50840FFB5396CB392D015B3AB9ABBDE48450E7090A7D65E45FD89640D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\d93925e5-34ef-48c1-8eda-452e022c6a6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21000
Entropy (8bit):	6.065198078037908
Encrypted:	false
SSDEEP:	384:jtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSp9BGfKQmRT9ljFgJ:JMGQ7FCYXGIgtDAWtJ4n9rGfKXxw
MD5:	2C23FBAC16CEC05053AE18C8AD60913F
SHA1:	4BED4DF8610AB575825C1B4B0EA9876E13ACDA18
SHA-256:	C542652799F90E0328D45C19AF15DB55056ED9F83531656FE9A0570D967D3611
SHA-512:	E3A3B00816A6E5B1A2945B987C1BED16993B389C03725F4E3AD6658FCC65523FAFBE6BD8A32D7AE64E85701BFFF61F3D0B7DE93286ED0607B46B4C9E4E12DE50
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563536791468","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\22c50dbc-26d4-4a14-8c59-7fcb6b5d6fd9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.834160163522839
Encrypted:	false
SSDEEP:	192:fsNwZD7eiRUQA1vQ5t91zOkKl96qRAq1k8SPxVLZ7VTiB:fsNwRF4Y5BZKl96q3QxVNZTiB
MD5:	FC90D721EC7F63E885506435F0777C79
SHA1:	E3FC624385C4D4BD86451FEEF0D72373A672F733
SHA-256:	A22EEB845014CCF0A9392E02070305A6755231F26C24641D216323556AB9F567
SHA-512:	6A80F40F4A16A84DD6C7D8F489BF607617516FFFD55AF060DAF09B102271D64B0112465D6B75FA8BB17C1B25CDA7F8F1ACBEFA850AFFD279E19A6FC27E0D13FF
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\266f3c1e-4156-40c5-a263-ad55317e57f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45526
Entropy (8bit):	6.082123160953715
Encrypted:	false
SSDEEP:	768:QMGQ7FCYXGIgtDAWtJ4neVtFowDKBqn7ILMrirN9jyV8IoKhjNIJ5vaS+OxzJ71d:QMGQ5XMBGmFH+pPB9GVxxIJIOxzJ7Qm
MD5:	138D3FF0D661478E76F44A61C4773D89
SHA1:	35FCE19C1DF7BDC28AD7D076E3F5CCAD98B03F2F
SHA-256:	083E268D1AC504880AFEE3CC40112F19BD903AB5D5F5CE307B00D4A9AD72D4B6
SHA-512:	F8D9CFCD0B2FE743500BFD10387044FFC76B1CF66F042AA84984D405BD575048B6BEA88B812F2F200F4249210517F63B5DB2360E6AD49CC9AEA35944022CD88E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563553996621","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2b763d1b-44dc-4810-8017-afc33eaf83fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4053ea20-b62f-4780-b581-1c480ef01cae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.801172840277996
Encrypted:	false
SSDEEP:	192:fsNwZD7eiRUQbQ1kKw6qRAq1k8SPxVLZ7VTiQ:fsNwRFsGKw6q3QxVNZTiQ
MD5:	FE14E0D3F08306ECF9146415698907BD
SHA1:	9E2443A51640BF9C3F62A31C89F7BA7C1800A51E
SHA-256:	A612C4CCCADE86450368300751D0CAE0A51D58D93346F70E6A4109FA686F8C1F
SHA-512:	5B253A2ADD3F633302921046DB518741350141DF1AC5E8171FBB748271C619A9DF06A348DBECACA154577C9D118D41492D5642B43CEF186469A6DDEE3187382F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43d82750-1d96-4a6b-9e8c-88f1c711e95a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.834160163522839
Encrypted:	false
SSDEEP:	192:fsNwZD7eiRUQA1vQ5t91zOkKl96qRAq1k8SPxVLZ7VTiB:fsNwRF4Y5BZKl96q3QxVNZTiB
MD5:	FC90D721EC7F63E885506435F0777C79
SHA1:	E3FC624385C4D4BD86451FEEF0D72373A672F733
SHA-256:	A22EEB845014CCF0A9392E02070305A6755231F26C24641D216323556AB9F567
SHA-512:	6A80F40F4A16A84DD6C7D8F489BF607617516FFFD55AF060DAF09B102271D64B0112465D6B75FA8BB17C1B25CDA7F8F1ACBEFA850AFFD279E19A6FC27E0D13FF
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\47b4e01a-4f3f-4b77-919f-bf9839781b7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45526
Entropy (8bit):	6.082119570867794
Encrypted:	false
SSDEEP:	768:QMGQ7FCYXGIgtDAWtJ4neVZFowDKBqn7ILMrirN9jyV8IoKhjNIJ5vaS+OxzJ71d:QMGQ5XMBGeFH+pPB9GVxxIJIOxzJ7Qm
MD5:	FAD6201E36F1A9CEEBD553C912752B9C
SHA1:	38E990A12BC2DF95576A4FA0815F5D263973AA70
SHA-256:	396505DF85098F76C57A7C90110FAB8C4EA5AB7E1A820B536083281A525021DF
SHA-512:	88B97B93BDC2EC450A2E7A1262B5262229612BBAD02089E9FE0C0EE61FEDAEF495CF2300C482B4B29D1376614AEEF2144502D650AE2F2CAFC6C2FE8646786F3D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563553996621","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\948b8074-0171-46a8-a802-e3d1b29d207f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.834188342727771
Encrypted:	false
SSDEEP:	192:fsNwZD7eiRUQA1vQ5tAyYkKl96qRAq1k8SPxVLZ7VTiB:fsNwRF4Y5ZjKl96q3QxVNZTiB
MD5:	3815B76EA0498432AB013215F54F784B
SHA1:	B490012562364991E3F78A090F4A88A03521F05F
SHA-256:	A78E90C03A74493665C7B9D7B53C26C06E62067AA56B60FB886D7F0818D21566
SHA-512:	DF2F6E53C7D2945C58F8DA0063C82826454A046EF3C75A6D3EC9F3AF2FF255A970FE4DDCCFF2C1C59212381305F3E001C2A12A28A8C6F920C6E2907F610BF5E6
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\965db92f-c8bf-4f5e-bfa4-559e73d93f46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.834188342727771
Encrypted:	false
SSDEEP:	192:fsNwZD7eiRUQA1vQ5tAyYkKl96qRAq1k8SPxVLZ7VTiB:fsNwRF4Y5ZjKl96q3QxVNZTiB
MD5:	3815B76EA0498432AB013215F54F784B
SHA1:	B490012562364991E3F78A090F4A88A03521F05F
SHA-256:	A78E90C03A74493665C7B9D7B53C26C06E62067AA56B60FB886D7F0818D21566
SHA-512:	DF2F6E53C7D2945C58F8DA0063C82826454A046EF3C75A6D3EC9F3AF2FF255A970FE4DDCCFF2C1C59212381305F3E001C2A12A28A8C6F920C6E2907F610BF5E6
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7cdf198c-b86c-491b-a8a5-42cd2be1bd50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D2C8A1-2350.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.30045793525723136
Encrypted:	false
SSDEEP:	3072:bec1ueLE8q4F/5MVNPUkRRaWJgMNkSZSsU0Z01rDmBw/c+Fms6NdqUg7GflpvsrN:L3XqQ1SZSsTatrx6faH6k
MD5:	A303B1682AB2E1CC9416B8EF75031055
SHA1:	F515D204235DC69AF85AD434E8A467C207C8451A
SHA-256:	CB4BA745D09CE04BC32C1DE86EBF5A4010FABF27571D40A3488E6281FBECEC60
SHA-512:	02E070D5E6ABDC93C3ECFACE79A336B4A9E2E9AC3895DED9C5364F5B7B884F9603A71ED2798EA574BA1FD8DB428F242E8B9196CCDD16592A6A76BDFA79567CFF
Malicious:	false
Preview:	...@..@...@.....C.].....@................$..X$..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".hbvxnm20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D2C8A9-200C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039751221820098506
Encrypted:	false
SSDEEP:	192:LA0EbtmqvDtKX7NJEa3XxxTVwg7XX+iV0DA5DhAVN3GKPU1gQMGB1lq01n8y08TQ:80EtaeQtjjnhUTkg6BbX108T2RGOD
MD5:	C7539A1FB5CB7ED670AAB459533DABCF
SHA1:	B1FB288363AB7332C1BD80A2BF40775BF7F9064D
SHA-256:	718A67838365394F62C5CC6391283F3BAE6ADCA54E47D8A96620198E1BBB1885
SHA-512:	BA5EEC2C60F611161FE1E1B552428F732609EA0FD3C764C3CC1CADDAB92475E4680ADBC07EBB9A1805399B5BE82C71082D3A94FE5B6441A6DBC152AE7461F62A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hbvxnm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D2C8B2-1E00.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03877246019180394
Encrypted:	false
SSDEEP:	192:hM0EbtmqvD3KX7nJEa3Xxx7UpXxgg6zfhj1NEr9fW1gQcHe+yzqln8y08Tcm2RGY:S0EtyeZVQh54ygjeFS08T2RGOD
MD5:	1952F4543D33E0D2509E564358972B0C
SHA1:	CABABCA525BD75DEF57E5A03BFEF286888C855FE
SHA-256:	4E8828887C0515BBDAF56DF530C35D0CDFEE9494B17B5C7EB62DE1906D28388C
SHA-512:	6B708EEE2B10C3BFD78B9FA2A2BD9157C1CB5D54FDE228AA41010A91508CDF1D84B7DDF151802BFCE38804A5346C32A5214EE48B9BBC9746AC115C02C0D08791
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hbvxnm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D2C8BE-1F10.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038821587148475965
Encrypted:	false
SSDEEP:	192:Il0EbtmqvD3KX7VJEa3Xxx7UpXxgg1o86hGjNEIGtM1gQMSYO6Zq2n8y08Tcm2Rl:i0EtseZVMhwLWsgOYvh08T2RGOD
MD5:	6D114139A4965F06F7258652273CD6AC
SHA1:	EA2B1FDBE8CBD06BBD6C457439291AA539F7A10E
SHA-256:	C952E56D9A40F86D7F0006AFF2579B6C9FC15B639A8A2C5B42DEEDE0041F7148
SHA-512:	7E01E7B202EE7C6D0AFE8E6F18CC0518FB325B9E386D297517166A007CFB1E0A3E21078FD10CB1722BF2A97C28F176339483B8021A96E2CF92C508D1D89D374F
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hbvxnm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\100c1325-54ce-4214-a821-72a3d659b8d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30244
Entropy (8bit):	5.566270454914445
Encrypted:	false
SSDEEP:	768:r/GLfm7pLGLv+nWPusfbr8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1afReEHrwJEpj6:r/GLfGcv+nWPusfbru1jawaf8EUmts
MD5:	A29566C375B45D2E3951BA58F9CAC8DE
SHA1:	7E1896FD063221F79D8E4E9D1CAB0EC4BB22DD36
SHA-256:	BD8015AF63B63CC3B2FA30450D6A5F2A5866BFECEF1E20F924E5CBE7BBCC835A
SHA-512:	658E1163DD7E7647D5EB72DEEC439EF03C8B1CD1E05D3118F50D999EBC685917521A8BBD830E376E91A230DBAC5E307DD4EA7FD8C3B5DFA4600AA81B681EA391
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563553757738","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563553757738","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\19920e48-2bbc-4bae-a8c1-e4bac6b3d44e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.182803745664665
Encrypted:	false
SSDEEP:	96:sVAqlSJ1ub9A5IYuXuEzm6SSAbur1YLsY5Th6Cp9/x+6M8muecmAeCF/e4zvrB24:sVAVJ3IP9mEAbuhYLsYPpj+FVA5BFBf
MD5:	EB548D4FAEFDF334BF341B9AD4B350F6
SHA1:	00ABE9D9927C7F20B776A7F1D8AF822841D181B2
SHA-256:	E1ED8B33A0BFC3F8F83E71438351BDB1526CE764F11C6A88DC922CC537152961
SHA-512:	FDCDF44513872485526D5EF411E8BC31D5C4178F07B7A3D695A5032A1251F08A9083A9E16B6DEAE62633275249D0E4593150EE475928F815BABC89101AC7858C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369563553972799","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3532f2c8-0352-4696-865c-2f110754412a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.18441074540722
Encrypted:	false
SSDEEP:	96:sVAqlSJ1ub9A5IYuXuEzm6SSAbur1YLsY5Th6Cp9/x+6M8muecmAeCe/e4zvrB24:sVAVJ3IP9mEAbuhYLsYPpj+FVAmBFBf
MD5:	6C9D20884CA76C104AB970B346A3A793
SHA1:	586982AF2350E0BCAA1DD049AD70EEE78A7E9921
SHA-256:	9493C356F7D759D79E0A7591CB9E5FF4ACD3DEC840FFA7D65DD0FB7BE1743ABF
SHA-512:	645B861637A29EE87826021D56269307202D4FC7452A14079C22D375C7BF154DB2CC4953A73763EA43719BDA0013F1B3A17209F413288020A260F04D2547E0A4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369563553972799","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5dd91d84-28ea-4a68-a397-bfbcd6e6b9e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3207608386389635
Encrypted:	false
SSDEEP:	192:EAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:3OEOKSXs/J7mGnQmLu5/5eNdl
MD5:	A6351BEAF216DBEAE079678B420F75B0
SHA1:	BCEDBAD9943A3A95D41037E4CB5150EAC3121B06
SHA-256:	D3D650E01C919A9A0FAC83140C3F23C41F331A489D3AA19F00E792A29D453FE5
SHA-512:	A14D10DAB7865FFCCCA6C23DA401296476EFFCF2C6231A7C96D44C569D26CF81B345C008B57D225CF3246D41B8B86A91FE73F7E494B9320766F6DB9EC9C83CBC
Malicious:	false
Preview:	...m.................DB_VERSION.1.h3.................QUERY_TIMESTAMP:arbitration_priority_list4...13369563556517483.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.10878265389168
Encrypted:	false
SSDEEP:	6:Zl1wkn23oH+Tcwt9Eh1ZB2KLlT8Vq2Pwkn23oH+Tcwt9Eh1tIFUv:ZYfYeb9Eh1ZFLx8VvYfYeb9Eh16FUv
MD5:	4049D472E83FC9FE997DA10A73E3DC4B
SHA1:	023E217F38E3128203B1576C0B409ABFED5689EF
SHA-256:	3797BB83E573262F74CD7C00673D37F6D338009EB943D476696D158849C33FBC
SHA-512:	0C3A2CA44952676E5CDE93DC974E9887FF87A907919FD51239EC3647FBCB6257CA661D09CBD2F7EBDC918BBE47198926832EF957E7FBD6060288B28B3A6BB57F
Malicious:	false
Preview:	2024/08/31-03:39:15.621 20e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/31-03:39:15.645 20e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlbFaK:Ls3bg
MD5:	2B1AEF5FFC2B074233B320576765297F
SHA1:	AB1617C641F4FB77606E12D14E35233C0978EE2F
SHA-256:	D9B98EB79C22447821E5CAA83984C797F8797421223B2348ED93E006F0F28948
SHA-512:	D81A7646FE14F0237B308B29EC8E26A7F97265A0E9D8BF9A454C75D581CBB6E04AFE18ACB3E4841DD4EFB4D9DF321F5B62CFDAA4373410ED75DF0375C1EE877C
Malicious:	false
Preview:	.........................................\q.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.20681179093472
Encrypted:	false
SSDEEP:	6:ZP6B1wkn23oH+TcwtnG2tbB2KLlT9UM+q2Pwkn23oH+TcwtnG2tMsIFUv:ZSkfYebn9VFLx9UM+vYfYebn9GFUv
MD5:	AEC12E513357343CACEA00FBF0F08A37
SHA1:	B19E3642BA8313011C249590B98ED3EEE622B902
SHA-256:	557603E231C6FE5C4FE68D409E293A8E19D8E47F44F341CBBEB9ED08D9BFF20E
SHA-512:	2BE924D5988B7C98C099CFDBE23F6B99248C0A6EBBB19C355828EEFBC95863E6049B9BA30827C750C9CE8F4C6C56C792215EE5DD55C47C669AEAB4FE2682B186
Malicious:	false
Preview:	2024/08/31-03:39:13.821 1f6c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/31-03:39:13.831 1f6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.1558806923263125
Encrypted:	false
SSDEEP:	6:ZbF+q1wkn23oH+Tcwt8aVdg2KLlTxGBAq2Pwkn23oH+Tcwt8aPrqIFUv:Zb01fYeb0LxwKvYfYebL3FUv
MD5:	ABC2CF05A087905E33684EE540106603
SHA1:	FAF391EEA3AB6E27AD507B32565F8899601F8A83
SHA-256:	707812E4BA8B5D16926FA7C1D78D17EFD26C71542842A31A90B2BAA8EE830B25
SHA-512:	0B0B8C907C73597B884D991D21935550E39704EF5B1F4440BA8400DD5316F4215BF7F4C44432F6924726E06C14BFE992057F592D41EC4318A0A9025D09535918
Malicious:	false
Preview:	2024/08/31-03:39:13.829 23d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/31-03:39:13.842 23d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.164514840289082
Encrypted:	false
SSDEEP:	6:ZX2+q1wkn23oH+Tcwt86FB2KLlTtIq2Pwkn23oH+Tcwt865IFUv:ZX2+1fYeb/FFLxGvYfYeb/WFUv
MD5:	EA56980379E646C5FA815BA7E62690D5
SHA1:	B039A1A0956B0153A8982D2F11F57483DBA4827D
SHA-256:	955FBC4ECC7CCA554D5B610218831C692DF43188D620A41EC1F708A771F30DD5
SHA-512:	91857ECA7D91B37EE9F941378EF15F678B5835C1A1DC1619BAD52B51222088BE1CC24A9825A6F4ED23090E2E4EC52F4AD12677AE08332C320131B00E1AC389AE
Malicious:	false
Preview:	2024/08/31-03:39:13.844 23d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/31-03:39:13.869 23d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.17062042471809
Encrypted:	false
SSDEEP:	6:ZCsN+q2Pwkn23oH+Tcwt8NIFUt82IZmw+2YVkwOwkn23oH+Tcwt8+eLJ:ZC1vYfYebpFUt82I/+2Q5JfYebqJ
MD5:	032CDA13437340579AD34CE5F3959B7D
SHA1:	07A54984CB1309A795DD4DCF629901DB8AE98A9F
SHA-256:	38269185DDE796A00423302A3206B11F016C9BD9AF00C59995A3A747C21FC9A1
SHA-512:	AAB0C1362DE66DF7D9187FE8019B659B83A4236F0A908A5C900BA9802DEBB7208AB009A7438D6FC272CC65AB327EC7E48244868D95FAB036F52BB40FF3BDC339
Malicious:	false
Preview:	2024/08/31-03:39:14.035 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-03:39:14.036 23f8 Recovering log #3.2024/08/31-03:39:14.036 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.17062042471809
Encrypted:	false
SSDEEP:	6:ZCsN+q2Pwkn23oH+Tcwt8NIFUt82IZmw+2YVkwOwkn23oH+Tcwt8+eLJ:ZC1vYfYebpFUt82I/+2Q5JfYebqJ
MD5:	032CDA13437340579AD34CE5F3959B7D
SHA1:	07A54984CB1309A795DD4DCF629901DB8AE98A9F
SHA-256:	38269185DDE796A00423302A3206B11F016C9BD9AF00C59995A3A747C21FC9A1
SHA-512:	AAB0C1362DE66DF7D9187FE8019B659B83A4236F0A908A5C900BA9802DEBB7208AB009A7438D6FC272CC65AB327EC7E48244868D95FAB036F52BB40FF3BDC339
Malicious:	false
Preview:	2024/08/31-03:39:14.035 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-03:39:14.036 23f8 Recovering log #3.2024/08/31-03:39:14.036 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3283577581710296
Encrypted:	false
SSDEEP:	6:/iA/J3+t76Y4QZZofU99pO0BYtqR4EZY4QZvGKO:/ThHQws9LdhBQZGKO
MD5:	4D96DF40F90D44E23F6C066A5A637FE7
SHA1:	90A6A5A2CD19C222A9E3C4FBBAA93575628205F8
SHA-256:	10667E2E31AAE8F42947FBEAE3CB6AAC41FC9EDE6035F13DA1995D1776734FAB
SHA-512:	50DA2FF5CE9D75D6EB0055602A3043FAB10D9E0EC978D1E8AFF97F9F0E040979F9ED652F22F82906087C39B9DFF34A2B6EF72BDF33DE923C65D5CF42E86DC644
Malicious:	false
Preview:	............+.....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.264156145356845
Encrypted:	false
SSDEEP:	12:ZWvYfYeb8rcHEZrELFUt821i/+21O5JfYeb8rcHEZrEZSJ:KYfYeb8nZrExg8wMYJfYeb8nZrEZe
MD5:	B01C12719F0293428061E3C7EF5EE34C
SHA1:	116675D975116FB9D82C4CA512980D73A8939DA4
SHA-256:	B90B659FEF6017C3733B95E8019BA3A37FDAB3FEF51FBD8261CE85C2C02136DE
SHA-512:	4825C6B4C46DF69BAFBD7C539A9856ED9E82F3378E11DDE54658F0C1A13ED1EEA84E3EB5D316F3D442A333CF983D1434DDDC0BA30FBB04EC9AA1BB884974300D
Malicious:	false
Preview:	2024/08/31-03:39:14.780 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-03:39:14.781 23c0 Recovering log #3.2024/08/31-03:39:14.781 23c0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.264156145356845
Encrypted:	false
SSDEEP:	12:ZWvYfYeb8rcHEZrELFUt821i/+21O5JfYeb8rcHEZrEZSJ:KYfYeb8nZrExg8wMYJfYeb8nZrEZe
MD5:	B01C12719F0293428061E3C7EF5EE34C
SHA1:	116675D975116FB9D82C4CA512980D73A8939DA4
SHA-256:	B90B659FEF6017C3733B95E8019BA3A37FDAB3FEF51FBD8261CE85C2C02136DE
SHA-512:	4825C6B4C46DF69BAFBD7C539A9856ED9E82F3378E11DDE54658F0C1A13ED1EEA84E3EB5D316F3D442A333CF983D1434DDDC0BA30FBB04EC9AA1BB884974300D
Malicious:	false
Preview:	2024/08/31-03:39:14.780 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-03:39:14.781 23c0 Recovering log #3.2024/08/31-03:39:14.781 23c0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.170757474504429
Encrypted:	false
SSDEEP:	6:Zekq2Pwkn23oH+Tcwt8a2jMGIFUt82YFZmw+2hFXkwOwkn23oH+Tcwt8a2jMmLJ:ZekvYfYeb8EFUt82Q/+2jX5JfYeb8bJ
MD5:	C0ADDC40D48B4897893EB94487568651
SHA1:	15E7AF3EE5F4121541A61EF84D0470711D2B260E
SHA-256:	A650924833357B814B1C510FB37FCAE944F2D5215E1E194531F49C84F2C73547
SHA-512:	CDE5DBC188DB177A5BA9F4DFDB1F44F41AA640A913A1014636196BEA1FB4C3D0089FAF8482BD324ACB1FB32D9C41485DAB0E817208330317748DDB1A97428FCA
Malicious:	false
Preview:	2024/08/31-03:39:14.642 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-03:39:14.644 20f0 Recovering log #3.2024/08/31-03:39:14.647 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.170757474504429
Encrypted:	false
SSDEEP:	6:Zekq2Pwkn23oH+Tcwt8a2jMGIFUt82YFZmw+2hFXkwOwkn23oH+Tcwt8a2jMmLJ:ZekvYfYeb8EFUt82Q/+2jX5JfYeb8bJ
MD5:	C0ADDC40D48B4897893EB94487568651
SHA1:	15E7AF3EE5F4121541A61EF84D0470711D2B260E
SHA-256:	A650924833357B814B1C510FB37FCAE944F2D5215E1E194531F49C84F2C73547
SHA-512:	CDE5DBC188DB177A5BA9F4DFDB1F44F41AA640A913A1014636196BEA1FB4C3D0089FAF8482BD324ACB1FB32D9C41485DAB0E817208330317748DDB1A97428FCA
Malicious:	false
Preview:	2024/08/31-03:39:14.642 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-03:39:14.644 20f0 Recovering log #3.2024/08/31-03:39:14.647 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\071e556a-aed3-4d42-a499-239723fd9e12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4cd44c87-ac73-4082-8629-ccdc38c9de64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2fcf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3ea32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d864.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e2b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2fcf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c769879a-64e2-4976-9711-1a517ba9eeff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8fb6d72-2af9-42f6-ab8b-4b0f09a80bb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6054134-1ccd-4fbe-a09c-b4a76a49f6b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d60bedd5-3738-4176-aa56-c2058374d1c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	822
Entropy (8bit):	5.294413373729474
Encrypted:	false
SSDEEP:	12:YHO8sq0sBZV1qy4dLA8sqwsBZnF1qRGudFGH8sqyVSsBZhQ4GJ/Ql7E4T3y:YXs0ZVMdBskZFRudFGcsHJZFGJ/W7nby
MD5:	44D697627BCD8E3D400F531629B41F2E
SHA1:	B4AE413C75A3135BC503E4412B3B955E2B349B73
SHA-256:	68DE00D152F2CFB8E8BB839C342FEBC0646072F07C3134565A190D37B405839F
SHA-512:	FFB52649717C18C07F6596D879A8E18A6176B05BB141A06E9C1963A6DBFFE026D05694EA584DA203B015CD5243AAAE7C0596027E8DDC0A03298B9CE324C9F17F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372155555846363","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372155556842603","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372155559377211","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e1ba2fcd-764a-48c8-9f52-d6d9b6208ccc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9161
Entropy (8bit):	5.183786934097537
Encrypted:	false
SSDEEP:	96:sVAqlSJ1ub9A5IYuXuEzm6SSAbur1YLsY5Th6Cp9/x+6M8muecmAeC8e4zvrB2Xo:sVAVJ3IP9mEAbuhYLsYPpj+FVAGBFBf
MD5:	894CE3DE6050C9A58631B4E3B66F0C65
SHA1:	BE6ACF6435BEEC8ABCB47E52F8D5C7D177EC498C
SHA-256:	EFFB070C9B3FC854FBF562D30C2FC9504AE2CB9786A39FDC23565702AEBDACBC
SHA-512:	D96BB0F1C3D4EE03C18DE8C29F1086381F828D64E59457CBE2BA4629AAD1022A5292E528EDBA155DE22795D38DF24EE4BDF9224D8CC7F8C4724B240E9A846B93
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369563553972799","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF36cb5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9161
Entropy (8bit):	5.183786934097537
Encrypted:	false
SSDEEP:	96:sVAqlSJ1ub9A5IYuXuEzm6SSAbur1YLsY5Th6Cp9/x+6M8muecmAeC8e4zvrB2Xo:sVAVJ3IP9mEAbuhYLsYPpj+FVAGBFBf
MD5:	894CE3DE6050C9A58631B4E3B66F0C65
SHA1:	BE6ACF6435BEEC8ABCB47E52F8D5C7D177EC498C
SHA-256:	EFFB070C9B3FC854FBF562D30C2FC9504AE2CB9786A39FDC23565702AEBDACBC
SHA-512:	D96BB0F1C3D4EE03C18DE8C29F1086381F828D64E59457CBE2BA4629AAD1022A5292E528EDBA155DE22795D38DF24EE4BDF9224D8CC7F8C4724B240E9A846B93
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369563553972799","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e1e5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9161
Entropy (8bit):	5.183786934097537
Encrypted:	false
SSDEEP:	96:sVAqlSJ1ub9A5IYuXuEzm6SSAbur1YLsY5Th6Cp9/x+6M8muecmAeC8e4zvrB2Xo:sVAVJ3IP9mEAbuhYLsYPpj+FVAGBFBf
MD5:	894CE3DE6050C9A58631B4E3B66F0C65
SHA1:	BE6ACF6435BEEC8ABCB47E52F8D5C7D177EC498C
SHA-256:	EFFB070C9B3FC854FBF562D30C2FC9504AE2CB9786A39FDC23565702AEBDACBC
SHA-512:	D96BB0F1C3D4EE03C18DE8C29F1086381F828D64E59457CBE2BA4629AAD1022A5292E528EDBA155DE22795D38DF24EE4BDF9224D8CC7F8C4724B240E9A846B93
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369563553972799","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566222106018367
Encrypted:	false
SSDEEP:	768:r/GLfm7pLGLv+nWPusfUr8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1afReEHrwJ8Ap2:r/GLfGcv+nWPusfUru1jawaf8EU6gtQ
MD5:	111C8BEC6E16C5FD08B1F48402C8553D
SHA1:	D6E6FF426D909DB721E377B96D567A069418E5C7
SHA-256:	AB0527DD663C46471C28AB36B752221A3FBA9A81C03D25F1559FEC3919F81A0D
SHA-512:	7E1E99946A8F2B44E7F30029CB545A44AAE96FC874F1EBBF1FC143E3B1E2C88E7C5168B6A1AA4DBE1C0D71D298C69159AC95EF03D70404E1859FA639D3F5F895
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563553757738","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563553757738","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF336e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566222106018367
Encrypted:	false
SSDEEP:	768:r/GLfm7pLGLv+nWPusfUr8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1afReEHrwJ8Ap2:r/GLfGcv+nWPusfUru1jawaf8EU6gtQ
MD5:	111C8BEC6E16C5FD08B1F48402C8553D
SHA1:	D6E6FF426D909DB721E377B96D567A069418E5C7
SHA-256:	AB0527DD663C46471C28AB36B752221A3FBA9A81C03D25F1559FEC3919F81A0D
SHA-512:	7E1E99946A8F2B44E7F30029CB545A44AAE96FC874F1EBBF1FC143E3B1E2C88E7C5168B6A1AA4DBE1C0D71D298C69159AC95EF03D70404E1859FA639D3F5F895
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563553757738","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563553757738","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.122309801320021
Encrypted:	false
SSDEEP:	6:ZOq2Pwkn23oH+TcwtrQMxIFUt82gZmw+2GkwOwkn23oH+TcwtrQMFLJ:ZOvYfYebCFUt82g/+2G5JfYebtJ
MD5:	93ED3296E8AE19A567893E34D4D36EF2
SHA1:	3AA255F2E037FA17449DC3A45EA752C353A35EBE
SHA-256:	CA58E09F7E14AC86E11D7FF3BFA98C355B76BE98C44EA3F1364C30EB66058A35
SHA-512:	BFBE7BF82BCA84B1C7BDB7A38B858514259A17E942077151A26342F5EC6728D3C1D8E24E7B11497864FDC40E053174F83C0FBAAE2DE425FE767D20903871B6CA
Malicious:	false
Preview:	2024/08/31-03:39:29.740 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-03:39:29.741 20f0 Recovering log #3.2024/08/31-03:39:29.743 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.122309801320021
Encrypted:	false
SSDEEP:	6:ZOq2Pwkn23oH+TcwtrQMxIFUt82gZmw+2GkwOwkn23oH+TcwtrQMFLJ:ZOvYfYebCFUt82g/+2G5JfYebtJ
MD5:	93ED3296E8AE19A567893E34D4D36EF2
SHA1:	3AA255F2E037FA17449DC3A45EA752C353A35EBE
SHA-256:	CA58E09F7E14AC86E11D7FF3BFA98C355B76BE98C44EA3F1364C30EB66058A35
SHA-512:	BFBE7BF82BCA84B1C7BDB7A38B858514259A17E942077151A26342F5EC6728D3C1D8E24E7B11497864FDC40E053174F83C0FBAAE2DE425FE767D20903871B6CA
Malicious:	false
Preview:	2024/08/31-03:39:29.740 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-03:39:29.741 20f0 Recovering log #3.2024/08/31-03:39:29.743 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.190547377695751
Encrypted:	false
SSDEEP:	6:Z6FrFMM+q2Pwkn23oH+Tcwt7Uh2ghZIFUt826FrFZZmw+2OMVkwOwkn23oH+TcwK:ZlM+vYfYebIhHh2FUt826/+2OMV5JfYz
MD5:	CFBD4804ABA7DD406A7A72E3DD7B042B
SHA1:	B5711C508D8D6BB77A06C8D9504656A7EC22267C
SHA-256:	864B92D7103507F7B2D53B85DEEE844C8A97B90140B5A51F06B436F58DB7E5F0
SHA-512:	252BE6ED647C0ABECADF2D24896A04818066CFCD36E141E03E0423CF737CD834282863932BFDF725C2E98392FE2503E66DB5D6631BA61AF5A23C82D7A8226AD7
Malicious:	false
Preview:	2024/08/31-03:39:13.797 1f6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-03:39:13.797 1f6c Recovering log #3.2024/08/31-03:39:13.798 1f6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.190547377695751
Encrypted:	false
SSDEEP:	6:Z6FrFMM+q2Pwkn23oH+Tcwt7Uh2ghZIFUt826FrFZZmw+2OMVkwOwkn23oH+TcwK:ZlM+vYfYebIhHh2FUt826/+2OMV5JfYz
MD5:	CFBD4804ABA7DD406A7A72E3DD7B042B
SHA1:	B5711C508D8D6BB77A06C8D9504656A7EC22267C
SHA-256:	864B92D7103507F7B2D53B85DEEE844C8A97B90140B5A51F06B436F58DB7E5F0
SHA-512:	252BE6ED647C0ABECADF2D24896A04818066CFCD36E141E03E0423CF737CD834282863932BFDF725C2E98392FE2503E66DB5D6631BA61AF5A23C82D7A8226AD7
Malicious:	false
Preview:	2024/08/31-03:39:13.797 1f6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-03:39:13.797 1f6c Recovering log #3.2024/08/31-03:39:13.798 1f6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulKP:LsP
MD5:	455B49D9C41F4EDFC84DEF06E7239AA6
SHA1:	07165B20F778112D9CB6C9E0FAFC3C9FD76D8633
SHA-256:	098BF38D58CB36BCE3B26A14A15C78714623E55540E74CA1A5C93A2CE4197A38
SHA-512:	67A8D088F76A28DCA52B63148E8168298CCA55E1C324373EA9E8CBA6B6AA3C93A0AFF8053A2CED653C6AE8EFCDE8E6F40BFB043D054016F573FF4EDF6B8B9FED
Malicious:	false
Preview:	........................................O...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlWmz/:Ls3Wmz/
MD5:	33BA347870C017FFE8F5C89DB7E7CCA2
SHA1:	EC3C992EA4C41E7A250A950338E5B949FB80FE27
SHA-256:	62041C9581B3E5B8B266A3C4D71718AAC3256DB12077EFEED4D1067089758B64
SHA-512:	4F1462F537EA34DE3EEB22C745608A095CA31192A091CBB48F05AA8679852147E9A23140BB77C6858BA441973F97313561D9037B2A3921546851F5114B1FFAF2
Malicious:	false
Preview:	.........................................u.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.27508051890983
Encrypted:	false
SSDEEP:	12:ZnvYfYebvqBQFUt827Y/+2m5JfYebvqBvJ:1YfYebvZg8GVJfYebvk
MD5:	0D2FBD0B65DCD6863F4E05CB7BEC9113
SHA1:	461D312544C4AF02D7EDCB2065C75666F01642D1
SHA-256:	90866AE3EAEE4F4F7F632A374B05ABD76B1366F03F466A1F4BB91A5F031748B5
SHA-512:	E18F5DBF5EFFD3AA40370C7C1336B7D33D650464759CFBAE507EB8B3720FF446D3673F4067CB35CE9304F6845271D7614083172BE4E0AD4BA8F0BBDD6FF6FA01
Malicious:	false
Preview:	2024/08/31-03:39:14.643 18d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-03:39:14.645 18d4 Recovering log #3.2024/08/31-03:39:14.650 18d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.27508051890983
Encrypted:	false
SSDEEP:	12:ZnvYfYebvqBQFUt827Y/+2m5JfYebvqBvJ:1YfYebvZg8GVJfYebvk
MD5:	0D2FBD0B65DCD6863F4E05CB7BEC9113
SHA1:	461D312544C4AF02D7EDCB2065C75666F01642D1
SHA-256:	90866AE3EAEE4F4F7F632A374B05ABD76B1366F03F466A1F4BB91A5F031748B5
SHA-512:	E18F5DBF5EFFD3AA40370C7C1336B7D33D650464759CFBAE507EB8B3720FF446D3673F4067CB35CE9304F6845271D7614083172BE4E0AD4BA8F0BBDD6FF6FA01
Malicious:	false
Preview:	2024/08/31-03:39:14.643 18d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-03:39:14.645 18d4 Recovering log #3.2024/08/31-03:39:14.650 18d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2be609cd-f5ef-4644-8e51-4532cd952c69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\57bfdab3-ea1c-4bd7-a881-489eac29e5c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3fabc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e2c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b1715c15-a077-4d9e-84af-e74a75a0c95e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bf2fce27-f625-42e2-ad82-af4017055b96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.224676489938252
Encrypted:	false
SSDEEP:	12:Z6vYfYebvqBZFUt82ih/+215JfYebvqBaJ:KYfYebvyg8FfJfYebvL
MD5:	BDEA23E13B04B009F50427321660A4EC
SHA1:	32E7C2AB5CFB2E7C653F90A4D2B86F81EC6F622D
SHA-256:	1547FD99DCBA2F915DB345786F8A5C1952F8733248AA7A6C5201D9D3DBAF56D6
SHA-512:	B9166C0F7E6D4FEA4491A84AB9D2AC116D5ECE11B6320A73CC3CCAABF4AAE3C47741314C382088558927388F30DAC29FBCF392EBC1A168E5D64009D76498892A
Malicious:	false
Preview:	2024/08/31-03:39:29.995 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-03:39:29.996 20f0 Recovering log #3.2024/08/31-03:39:29.999 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.224676489938252
Encrypted:	false
SSDEEP:	12:Z6vYfYebvqBZFUt82ih/+215JfYebvqBaJ:KYfYebvyg8FfJfYebvL
MD5:	BDEA23E13B04B009F50427321660A4EC
SHA1:	32E7C2AB5CFB2E7C653F90A4D2B86F81EC6F622D
SHA-256:	1547FD99DCBA2F915DB345786F8A5C1952F8733248AA7A6C5201D9D3DBAF56D6
SHA-512:	B9166C0F7E6D4FEA4491A84AB9D2AC116D5ECE11B6320A73CC3CCAABF4AAE3C47741314C382088558927388F30DAC29FBCF392EBC1A168E5D64009D76498892A
Malicious:	false
Preview:	2024/08/31-03:39:29.995 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-03:39:29.996 20f0 Recovering log #3.2024/08/31-03:39:29.999 20f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.232071800045961
Encrypted:	false
SSDEEP:	6:Zr4q2Pwkn23oH+TcwtpIFUt82QRNJZmw+2QRNDkwOwkn23oH+Tcwta/WLJ:ZsvYfYebmFUt82Q9/+2QP5JfYebaUJ
MD5:	A772A21956329D140146618A0C544BB6
SHA1:	801B57DB0F12CF7C4CC26F6507CCCEF4882B5C8C
SHA-256:	896AD824A76DC5937E144EFB4012CC5B76139D8F46BD05FE9BE31BEECE5A94EA
SHA-512:	04D6D78C90DE76D3AC5549A490301056BD65450F10263B3A81AD47B877F539A20EA323AB904AFA6E4917DACE546C31E9F51E466D448984DA02866C6FCDC2BE31
Malicious:	false
Preview:	2024/08/31-03:39:13.935 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-03:39:13.936 1f84 Recovering log #3.2024/08/31-03:39:13.936 1f84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.232071800045961
Encrypted:	false
SSDEEP:	6:Zr4q2Pwkn23oH+TcwtpIFUt82QRNJZmw+2QRNDkwOwkn23oH+Tcwta/WLJ:ZsvYfYebmFUt82Q9/+2QP5JfYebaUJ
MD5:	A772A21956329D140146618A0C544BB6
SHA1:	801B57DB0F12CF7C4CC26F6507CCCEF4882B5C8C
SHA-256:	896AD824A76DC5937E144EFB4012CC5B76139D8F46BD05FE9BE31BEECE5A94EA
SHA-512:	04D6D78C90DE76D3AC5549A490301056BD65450F10263B3A81AD47B877F539A20EA323AB904AFA6E4917DACE546C31E9F51E466D448984DA02866C6FCDC2BE31
Malicious:	false
Preview:	2024/08/31-03:39:13.935 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-03:39:13.936 1f84 Recovering log #3.2024/08/31-03:39:13.936 1f84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746027
Encrypted:	false
SSDEEP:	3:Dl2l/l1lhtlV:Dl2F3l
MD5:	811B092352396376EABDCB6E2F5D5DF5
SHA1:	A34CE4CD32A5B1ADB61AA958E697DD390365113C
SHA-256:	675901AF788C7AE9F2ED29F850234B6FFD1A586802CF2DDCE456747AB9B0D134
SHA-512:	F4CEB1FB0FB1069E1EF7BCFC589E4F2B48B8EFBE0273BFC54A9D5E29DF906E1E7ACCD837E94D56ECD7D0656BB991F51387920E91FA11280175E69D2152B8EB9F
Malicious:	false
Preview:	............<..X...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b13a4796-14fc-484c-8851-fb7307cc6793.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566222106018367
Encrypted:	false
SSDEEP:	768:r/GLfm7pLGLv+nWPusfUr8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1afReEHrwJ8Ap2:r/GLfGcv+nWPusfUru1jawaf8EU6gtQ
MD5:	111C8BEC6E16C5FD08B1F48402C8553D
SHA1:	D6E6FF426D909DB721E377B96D567A069418E5C7
SHA-256:	AB0527DD663C46471C28AB36B752221A3FBA9A81C03D25F1559FEC3919F81A0D
SHA-512:	7E1E99946A8F2B44E7F30029CB545A44AAE96FC874F1EBBF1FC143E3B1E2C88E7C5168B6A1AA4DBE1C0D71D298C69159AC95EF03D70404E1859FA639D3F5F895
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369563553757738","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369563553757738","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c8b230f2-1880-43f1-940d-3ea0e7c7dd22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d129c2d9-8190-4516-b0e0-f069348356bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9161
Entropy (8bit):	5.183786934097537
Encrypted:	false
SSDEEP:	96:sVAqlSJ1ub9A5IYuXuEzm6SSAbur1YLsY5Th6Cp9/x+6M8muecmAeC8e4zvrB2Xo:sVAVJ3IP9mEAbuhYLsYPpj+FVAGBFBf
MD5:	894CE3DE6050C9A58631B4E3B66F0C65
SHA1:	BE6ACF6435BEEC8ABCB47E52F8D5C7D177EC498C
SHA-256:	EFFB070C9B3FC854FBF562D30C2FC9504AE2CB9786A39FDC23565702AEBDACBC
SHA-512:	D96BB0F1C3D4EE03C18DE8C29F1086381F828D64E59457CBE2BA4629AAD1022A5292E528EDBA155DE22795D38DF24EE4BDF9224D8CC7F8C4724B240E9A846B93
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369563553972799","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	124
Entropy (8bit):	4.264133460112791
Encrypted:	false
SSDEEP:	3:VVXntjQVvseGKT9rcQ6xgoCgljl:/Xnt8vsedhOgoJljl
MD5:	71C15645FA4245AB57E91CC2D1F601E8
SHA1:	69FA53E61326CE1B2BE37831F2AF768B3014F84C
SHA-256:	DA2E0CBC5B20F46C0EB0B465CBCA4F7A06A4B08CA39B3C8ED7444718A3C2BCB0
SHA-512:	C9EC76ECD2094BAB6AB2AB7261A7E14D0AC127F150A37A31BFADC33876C60ABD395830212C7EE1CC90A0D8F4B386139DB9BB0B60A2BDC82A0AB3DE7E07DB4BCA
Malicious:	false
Preview:	A..r.................20_1_1...1V...0................39_config..........6.....n ....1..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.220779332050237
Encrypted:	false
SSDEEP:	6:ZTVq1wkn23oH+Tcwtfrl2KLlTw5q2Pwkn23oH+TcwtfrK+IFUv:ZTV1fYeb1Lx8vYfYeb23FUv
MD5:	EB6BFA0F9F8333C87E5D8925928F0E6E
SHA1:	3D8E5F4308CF7339B7AF149BACC750ED90DE30E4
SHA-256:	A3802812810FE03FBB8CBA7841379F74CB7CBF4E08ED93013D3F77AE90E6AA09
SHA-512:	B31D9640EEA2CA56991E1A2AF1E3442791DDDCD66E81111DE8596BAC3BE4A2C8136F1DDC8C37D8515B67F590211E680F2D00B2A40F791803F9C3CDBCA61F71C3
Malicious:	false
Preview:	2024/08/31-03:39:14.391 23d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/31-03:39:14.415 23d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	588
Entropy (8bit):	3.8952356734811686
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PAC+/Wc/ogDOap:G0nYUtPrPJ6B/XMtzNP0/c0
MD5:	87CFBFEB929BD94652E64ED22B3F4CA2
SHA1:	4B50E7C88B5D7F1533F60B40BFD4710126F52415
SHA-256:	A97A3464E514D18A5A3285AAD042F2A70467D8969426DC7665C61EBFC7F7933E
SHA-512:	886C8B97151065F7E71A9887976D3129EA9A1A644120AF420E2C239FF48A0B3F6D7480F7503086B36D95B31ABBBBE13BBFD362FC48FFC72D1689AE9ECAFC9378
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.......ln.................19_......Y...................18_..........................37_.....W%..................38_.....s...................39_......._c.................21_......de.................9_..........................9_......Gt&.................21_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.194390644261872
Encrypted:	false
SSDEEP:	6:Zw+q1wkn23oH+Tcwtfrzs52KLlTX/q2Pwkn23oH+TcwtfrzAdIFUv:Zw+1fYebs9LxPvYfYeb9FUv
MD5:	78BB4CF3817E810F6CFBE320C5BA72C4
SHA1:	3E2E2222B4C8C13A879768034AF0475C70FAE595
SHA-256:	59ED13E03A26955A2793A75677F36D7D28E6D1173ADAD4AFE1E2556944CB2480
SHA-512:	5862BE3A9BF9C01ECDF1F3B4697326A7EA364CF8F748A2B39789462560A9ACEE11E1BCFEB1D9166061C2467831BB98D1973EADD9EE9F70F87E1523F9D161312E
Malicious:	false
Preview:	2024/08/31-03:39:13.976 23d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/31-03:39:14.388 23d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlwK:Ls3/
MD5:	2EE25CC532CE6CE21BECA171E4F92C26
SHA1:	C8E7079C0A307FB6F872147B4F07CC75733299DC
SHA-256:	D952386B6518A1B7C92E71E52B22F4528D8216BD1F9F342070E6378E9684ECA3
SHA-512:	0A56FF74AC18C0D1ACD218852E822ED578DE678F4C29AC26E189528921B2EB95C68FFF6F21B5B1421F1557AF93D6FD91664990EB32A36FB37CAAFF1D5B427976
Malicious:	false
Preview:	.........................................]}.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlL0Kl:Ls3Y
MD5:	D6AF5158B8A1633968A675D29DBCD1A5
SHA1:	0DF5E5D63D03801C7A228545E0307FDCCF1692F1
SHA-256:	9267A0909B5CA8B5ED2D092E762F4E62FC03C9A6B30AC8C4851EA9D209942E51
SHA-512:	96525FCDDFBD0022791705ADB49D2BCA7F773BA51376238965E8EBC18017DA1E0F68F1D9D50FAB8646300444CF6AC5AE9F4344923825DAC0F64ACA6FC6980D08
Malicious:	false
Preview:	..........................................}.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d111.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2efa5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2efd4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2efe4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF310ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF342d6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ba87.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e1a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF408d6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4313e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795052084086775
Encrypted:	false
SSDEEP:	96:iaqkHfxHf5ih/cI9URLl8RotomMFVvlwh8e4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akZoeiRUZhs6qRAq1k8SPxVLZ7VTiq
MD5:	E66F5E3EFC53049CF86521CA7D893CEA
SHA1:	0989A7D9DADF463FA6425BE560F87529C1D1FC68
SHA-256:	506913C22C8F7246DD9B099AA024786BC2BEE7491E81BC6F2735A538AD4A1E9B
SHA-512:	1911471BE6EC73FF717D2AEB8085B7A118101FEDBDE1CC6864F42D8FBE79B6185C55E969BA6D127941C2F3BFA2A49487DD4F5A7499C820DD2AF3F5C6BCDA7518
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABJezlMnfvQT4RaRt79zBQREAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABCYjaFaCNvROXo8EgIGLOet1eqAopL4OIFJG2QF36WXgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031345
Entropy (8bit):	4.001531149645986
Encrypted:	false
SSDEEP:	49152:8gPh2N/MR+DgVFIlq6hT17X4Vrgtk+lzKVSf4YVxeqOWlcKRayjH09nnwBXQ0a/B:t
MD5:	72C8D70F20839746AF737D59CFEADD5E
SHA1:	56382FA78620B2A5CC81D88DFEE47A3884A6A6A7
SHA-256:	A249C01F9785A5CE8C4E373177F3CEA314535D1CB979720A54CC1D5CD66B1BAC
SHA-512:	30C1B09A067FDC4A5DF1F3D204410F373565E9621E71632137C9933E73153E3F34B73CEC3BF54A5B9F4C20C45B6C5CA3556BDB5749F4D7972973F1939C91C98B
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2031345
Entropy (8bit):	4.001531149645986
Encrypted:	false
SSDEEP:	49152:8gPh2N/MR+DgVFIlq6hT17X4Vrgtk+lzKVSf4YVxeqOWlcKRayjH09nnwBXQ0a/B:t
MD5:	72C8D70F20839746AF737D59CFEADD5E
SHA1:	56382FA78620B2A5CC81D88DFEE47A3884A6A6A7
SHA-256:	A249C01F9785A5CE8C4E373177F3CEA314535D1CB979720A54CC1D5CD66B1BAC
SHA-512:	30C1B09A067FDC4A5DF1F3D204410F373565E9621E71632137C9933E73153E3F34B73CEC3BF54A5B9F4C20C45B6C5CA3556BDB5749F4D7972973F1939C91C98B
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl0Kll:Ls30+l
MD5:	7249FF22DC2903BA6103FE935B937F16
SHA1:	07446F2508B536E99323A80B61780EB4FDBB5572
SHA-256:	9DAB29CB259AF4D9655FF8B0C9D7FB816B9977E37F4D70853A10AB2E74DF6F04
SHA-512:	C871FD95C0014C5D5DA8C60179CB8C05E50164A4F6AFCA6AD4948C9422E6711C6EEE73CC10FC7C8F48F1257BEDA119FB3C02D061A1702BBF535C8153606FD356
Malicious:	false
Preview:	..........................................j.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b192fcb7-c09d-488c-b06d-945cf91c15e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24664
Entropy (8bit):	6.053715466833122
Encrypted:	false
SSDEEP:	768:QMGQ7FCYXGIgtDAWtJ4nes+OxzJ71yh02tde:QMGQ5XMBGSOxzJ7Mm
MD5:	705545A1158FFFB7198D142A645A3FE1
SHA1:	AD66FFE07A87787462460A36B39BF0BF52124EC1
SHA-256:	70546A9B27ACBF4127F7317D159DFE6BC42C692EFBACEC9AF47C4EFB357392ED
SHA-512:	F78BAEB6C2A1EC8EA95C0FCC5FAA2A8146096AC759B3D101EE358B8D283AD20B4098C3DCCA30DF92E00FBBF8AF587C52BE6378407FC5C68919DE6BE4F7AD355E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563553996621","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c56c65b5-a99c-4de2-9b0d-94d2729cb34f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.807437518614749
Encrypted:	false
SSDEEP:	192:fsNAZD7eiRUzbQ1kKw6qRAq1k8SPxVLZ7VTiQ:fsNARYsGKw6q3QxVNZTiQ
MD5:	55158122A304FA9C6C78B3A45859286E
SHA1:	0F6AEC4A732925818BC9A4774D7822C076F0569D
SHA-256:	97BE262C5987C8E8A1FC4B217DADFA947D2FA29B6125CA751E3A91B403C5FD42
SHA-512:	D720BBA09799AB9456F3DFF8D117C0CA9FD2C743751B0AC7DBC265643FD706428AF469C1408355BF9F47C99496B2878A58A347FCC54B2A36905DFE6F02F8280E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\db183926-a5a7-47d5-9667-b047e8b1ad14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45565
Entropy (8bit):	6.081999231859584
Encrypted:	false
SSDEEP:	768:QMGQ7FCYXGIgtDAWtJ4nBVtFowDKBqn7ILMrirN9jyV8IoKhjNIJ5vaS+OxzJ71d:QMGQ5XMBGxFH+pPB9GVxxIJIOxzJ7Qm
MD5:	E5111663828E458EB17A1CF0F00D5AC1
SHA1:	7E7D796EDCA3AF3B6E71152EDDC056B9FFE3009A
SHA-256:	5CE17B31DC1064ECEC46B76E5DFFD9C9AFCE7B27B992365F2547AC16FA670A37
SHA-512:	B66F3C931A7D6487D7F83120413FA478135047C6B4CC108F156D3C4DE4A4875F69B6F59D3B4591CBDDCB7CF235EF2BC67ADAE1376FF26D1545040762B7EF69C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563553996621","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f3695a8c-bf29-4aa1-8005-d25c55a5494b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058938756504261
Encrypted:	false
SSDEEP:	384:QtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwG+CGKf+Mh0lkdHd5qp:QMGQ7FCYXGIgtDAWtJ4ntCGKzh02tde
MD5:	E2F77C3613F04FF31E7E201B0040DCB6
SHA1:	B4A1AEB212F37980DF6D93F4B984E31A40BBC954
SHA-256:	891E77C35B9312453270306BBCD9EA5807BE4D0E4F81C2FC20AE57B9F21FEAF8
SHA-512:	41B204196F1C5BDA0DDB88B70DD26BEAE4F4FF0DA12072E5378BA06AFD514F53345BC250D531DC4CAB38E6D1385486F4C106A4EA0644D1370FAFD11A22197FB9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369563553996621","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.854543858153859
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxpxl9Il8uJU1jfJj0eZJNCDEPmG5oflcGnd1rc:mcYAJj0eZD4qmG5ovw
MD5:	7044570A25CBE6DD4C49305618C3B84C
SHA1:	A75FEB1A9F2D05EA62EC7FF63DB48E21ADF41A4F
SHA-256:	C5A4C45D59BE6997D284AF92D38092E754F044BC130743C9452C097E31DDB4A4
SHA-512:	5AA98C03DF314E6406B26F5DC8E14C587ACB0AFBC182876CE415ACFE4E1A4E4CDA26C1A07B5CC173EBE718FBA7BBFDA5E6186B518E7FD0C5166803F877ED77CE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.2.c.O.I.H.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.S.X.s.5.T.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9993718189101637
Encrypted:	false
SSDEEP:	96:GYAnE0Z5AiPCzPspWdWEcH1Vbz2aJom6/W/p2tM:Gf/Z+ikPs4d5cH1VA/u8M
MD5:	4F4EFF5EEAF8BB6B5CCA04DA509B49AC
SHA1:	6C61CF986FD6072B2FA670F5D799FE72BF07CD34
SHA-256:	A7C0E0C48770C9B23E973D8F825CF717D0A42941480212860ED27A4272E2A7E5
SHA-512:	8F3ECA98E0D6F3ADB79D739A4CE9DF0CCC88E72D56845FAB434AA8D28E4667D075AD34495E5BD7EEB20522557DF77952355402FA9984E492755AC06A9A1B5996
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.N.u.H.n.n.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.S.X.s.5.T.J.

C:\Users\user\AppData\Local\Temp\178b901a-a18e-4e59-b06b-002939f9ea7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\51565542-90ed-4f2a-b405-9a38345e0cc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\9bcb799c-0747-4c43-bd00-95300f7df62a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.318874467508918
Encrypted:	false
SSDEEP:	12:YpsxVAmmL0Dkv/Pqg2qx56s/Pq12FL0Dkv/P7dYN56s/C:YpsxVA5L08qgR5xq1aL087dm5M
MD5:	C4E7027135260E0C7EA0A0CB1CD34A4D
SHA1:	1B91CF139391812C87AAF9FE80582CE2EE0BBBB8
SHA-256:	FF3887620A90E354B26F8C21255A4E8F6B374A0220AE21F9D55B8B7CFB864630
SHA-512:	60939C66FF0E7BA21BA14CCF5D175634F0D142C53CB5F40065D6903F77952F29D3B619D51CA0010DFAE2506075F70964347B9266F8A155C04A991CE78F50A06C
Malicious:	false
Preview:	{"logTime": "0831/073900", "correlationVector":"3292C09BC719488681CB090008733F37","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/073915", "correlationVector":"XMm+zgwT5YiX9IbFo7mttC","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0831/073915", "correlationVector":"EDB517F2CB434C5893FCFF77E1B19F1D","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/073916", "correlationVector":"AfgiowHY10PnXpMAv3HjwO","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\de3d5324-db15-4cc8-870f-21808652697c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\178b901a-a18e-4e59-b06b-002939f9ea7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9040_1455888224\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir9040_82880006\51565542-90ed-4f2a-b405-9a38345e0cc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir9040_82880006\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9040_82880006\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9040_82880006\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9040_82880006\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5097330405764446
Encrypted:	false
SSDEEP:	48:eEt5dOESRsJ+r9zBdLXuHfkDpo2AcsAdOEARsJ+r9zngdLXuHfk+21:43u/kDLSnIu/kz
MD5:	133DA4D9C0E8D07E10611550B563F8D2
SHA1:	07027FE9F497AAD68848D516487EBB4027705E24
SHA-256:	0A2B8C221A341595BE8CECBB366B49027A8F6E669091508AC54D91DDF4E772FC
SHA-512:	EE25D8DC569EA361FA2A6D0265A63164AF78CDC197E00D3ABD7CB04E9EED88911AB44C37FDDECC6D6C371DB497DA1AD6009D56B9875096DB0FD5F3E8E8429D5F
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....]..x....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.......A.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.<..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.<..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.<....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........8c{......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SABH6P2DUX2HG3JLRYOA.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5097330405764446
Encrypted:	false
SSDEEP:	48:eEt5dOESRsJ+r9zBdLXuHfkDpo2AcsAdOEARsJ+r9zngdLXuHfk+21:43u/kDLSnIu/kz
MD5:	133DA4D9C0E8D07E10611550B563F8D2
SHA1:	07027FE9F497AAD68848D516487EBB4027705E24
SHA-256:	0A2B8C221A341595BE8CECBB366B49027A8F6E669091508AC54D91DDF4E772FC
SHA-512:	EE25D8DC569EA361FA2A6D0265A63164AF78CDC197E00D3ABD7CB04E9EED88911AB44C37FDDECC6D6C371DB497DA1AD6009D56B9875096DB0FD5F3E8E8429D5F
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....]..x....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.......A.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.<..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.<..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.<....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........8c{......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YIDODT0DSDC6GTJC6M1K.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5050984779195233
Encrypted:	false
SSDEEP:	48:eEcsAdOEARsJ+r9zBdLXuHfkDpo2AcsAdOEARsJ+r9zngdLXuHfk+21:x3u/kDLSnIu/kz
MD5:	061EC583F4D529A8674A4386A9E52702
SHA1:	36ABEA1B40F385954E69A08AB812FBCBCBF73FEA
SHA-256:	16B5750099C2424FFEF9F351F8A5EA6401FAFE685CF414FF9B56C77124EA1B1E
SHA-512:	35368CD9C3283E4A2C60AEE21FF38545817211C4772491696033348B040C15FE00CB075E0562C6FFB002D7AE70445418ED5E6DA78DEBC468D7329DAAFCB6A43F
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....]..x....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y.<..PROGRA~2.........O.I.Y.<....................V.....1'j.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.<..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.<...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.<..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.<....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........8c{......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5050984779195233
Encrypted:	false
SSDEEP:	48:eEcsAdOEARsJ+r9zBdLXuHfkDpo2AcsAdOEARsJ+r9zngdLXuHfk+21:x3u/kDLSnIu/kz
MD5:	061EC583F4D529A8674A4386A9E52702
SHA1:	36ABEA1B40F385954E69A08AB812FBCBCBF73FEA
SHA-256:	16B5750099C2424FFEF9F351F8A5EA6401FAFE685CF414FF9B56C77124EA1B1E
SHA-512:	35368CD9C3283E4A2C60AEE21FF38545817211C4772491696033348B040C15FE00CB075E0562C6FFB002D7AE70445418ED5E6DA78DEBC468D7329DAAFCB6A43F
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....]..x....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y.<..PROGRA~2.........O.I.Y.<....................V.....1'j.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y.<..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.<...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y.<..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.<....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........8c{......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579750841553813
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	baaed183eb33ca6aca19800f393a4c1e
SHA1:	83bfece6cf93eff7d036a5bf7bdf81f6f7161808
SHA256:	377cfca92e30bf58d3e736aa75e7341c7ad9a5962331e46ae25971e81b632d81
SHA512:	f91dd225a643cd713221969feb2891569a5b179bc2d8ff5135d937870fc1f15356639ea0a577c59f001aef14fa5ac5fea4703f721960681a763568cb47e9b58c
SSDEEP:	12288:2qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTY:2qDEvCTbMWu7rQYlBQcBiT6rprG8asY
TLSH:	E8159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D2C4B6 [Sat Aug 31 07:22:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FE8E134FBF3h
jmp 00007FE8E134F4FFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE8E134F6DDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE8E134F6AAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FE8E135229Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FE8E13522E8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FE8E13522D1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	c857c5f58e31db1adc0603fa619bb585	False	0.2869010416666667	data	5.164916873229449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 09:38:49.915975094 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 31, 2024 09:38:59.524214983 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 31, 2024 09:39:00.615385056 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:00.615392923 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:00.615436077 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:00.615699053 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:00.615708113 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.262113094 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.262713909 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.262733936 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.263772964 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.263868093 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.265537977 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.265610933 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.265953064 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.265966892 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.289077044 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.289105892 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.293596983 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.293596983 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.293623924 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.309359074 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.363394022 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363411903 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363419056 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363444090 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363472939 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.363487005 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363507986 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.363568068 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.363790989 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363827944 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.363915920 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.364598036 CEST	49745	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.364618063 CEST	443	49745	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.942922115 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.986862898 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.994446039 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:01.994457960 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:01.994940042 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.017132998 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.017215967 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.020344973 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.060502052 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120759964 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120779991 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120788097 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120800972 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120807886 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120810986 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.120938063 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.120953083 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.121000051 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.207669020 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.207679033 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.207712889 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.207772017 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.207783937 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.207827091 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.207849026 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.210258007 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.210277081 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.210365057 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.210365057 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.210371971 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.211914062 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.296092987 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.296119928 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.296152115 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.296219110 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.296227932 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.296227932 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.296297073 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.348845959 CEST	49748	443	192.168.2.4	13.107.246.57
Aug 31, 2024 09:39:02.348864079 CEST	443	49748	13.107.246.57	192.168.2.4
Aug 31, 2024 09:39:02.645875931 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:02.645917892 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:02.645982027 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:02.646344900 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:02.646375895 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:02.646418095 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:02.646698952 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.646708012 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:02.646761894 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.647352934 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.647361040 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:02.647480965 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.647718906 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.647732019 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:02.647896051 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:02.647907019 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:02.648063898 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:02.648077011 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:02.648391008 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.648400068 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:02.697045088 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.697077990 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:02.697138071 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.697971106 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:02.697983980 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.088419914 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:03.088440895 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:03.088907957 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:03.090555906 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:03.090568066 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:03.104430914 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.104756117 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.104764938 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.105650902 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.105719090 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.106539011 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.106609106 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.106762886 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.106769085 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.110838890 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.111000061 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.111016989 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.111869097 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.111928940 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.112679958 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.112732887 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.112797022 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.114737034 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.114928007 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.114934921 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.115400076 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.115571976 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.115581989 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.115906954 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.115961075 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.116449118 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.116533041 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.116884947 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.116942883 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.117423058 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.117429972 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.117762089 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.117830038 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.117932081 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.149954081 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.151426077 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.151624918 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.151633978 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.152601957 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.152664900 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.153552055 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.153624058 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.153709888 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.160501003 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.160506010 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.165934086 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.165942907 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.165949106 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.165976048 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.165985107 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.196501970 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.197046995 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.197051048 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.212052107 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.212053061 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.236982107 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.237036943 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.237175941 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.237241983 CEST	49756	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.237256050 CEST	443	49756	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.242674112 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.246278048 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.246326923 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.246814966 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.246925116 CEST	49757	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.246937990 CEST	443	49757	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.247944117 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.247992992 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.248104095 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.248178959 CEST	49754	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.248183012 CEST	443	49754	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.254874945 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.254928112 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.255342007 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.255465984 CEST	49755	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:03.255474091 CEST	443	49755	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:03.288606882 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.288652897 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.289138079 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.289227009 CEST	49758	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:03.289232016 CEST	443	49758	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:03.748444080 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:03.748539925 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:03.757605076 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:03.757620096 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:03.757843971 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:03.800591946 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:03.848498106 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:04.023643017 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:04.023710012 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:04.023848057 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:04.023870945 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:04.023883104 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:04.023883104 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 31, 2024 09:39:04.023890018 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:04.023895979 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 31, 2024 09:39:04.066952944 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.066996098 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.067065001 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.067321062 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.067363977 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.067425966 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.067548990 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.067563057 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.067668915 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.067682981 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.083018064 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:04.083044052 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:04.083127022 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:04.083659887 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:04.083673000 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:04.520761967 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.521235943 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.563940048 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.573940992 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.622301102 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.622312069 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.622602940 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.622611046 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.622805119 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.623301983 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.623785973 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.623853922 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.625276089 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:04.625320911 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:04.625375032 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:04.627203941 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.627305031 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.628304958 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:04.628320932 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:04.666477919 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.670067072 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.705976963 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:04.706068039 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:04.788672924 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:04.788726091 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:04.788899899 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:04.789371014 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:04.789385080 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:04.864510059 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:04.864527941 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:04.864888906 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:04.866216898 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:04.908502102 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:05.046506882 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:05.046567917 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:05.046632051 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:05.047898054 CEST	49762	443	192.168.2.4	23.43.61.160
Aug 31, 2024 09:39:05.047916889 CEST	443	49762	23.43.61.160	192.168.2.4
Aug 31, 2024 09:39:05.101620913 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.101676941 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.101775885 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.102024078 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.102036953 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.109561920 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.109746933 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.109764099 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.110124111 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.110188007 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.110795021 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.110850096 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.111924887 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.111989975 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.112230062 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.112237930 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.165716887 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.223614931 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.223695040 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.223817110 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.224286079 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.224301100 CEST	443	49763	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.224329948 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.224351883 CEST	49763	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.266431093 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.266635895 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.266655922 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.267045975 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.267106056 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.267811060 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.267857075 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.268037081 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.268115997 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.268228054 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.312501907 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.322348118 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.322355032 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.369024038 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.383061886 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.383187056 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.383261919 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.383631945 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.383646011 CEST	443	49764	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.383666992 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.383685112 CEST	49764	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.526892900 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.526932955 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.527199030 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.527400017 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.527411938 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.562927961 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.563184977 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.563195944 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.564162970 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.564222097 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.565205097 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.565264940 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.565660000 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.565668106 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.619317055 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.659799099 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.659837008 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.659873009 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.659888029 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.659898996 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.659945011 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.659957886 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.659965038 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.660002947 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.660003901 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.660073042 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.661355019 CEST	49765	443	192.168.2.4	142.250.80.68
Aug 31, 2024 09:39:05.661370039 CEST	443	49765	142.250.80.68	192.168.2.4
Aug 31, 2024 09:39:05.690880060 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.690906048 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.690963030 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.691528082 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.691539049 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.014647007 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.014919043 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.014942884 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.015264988 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.015399933 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.015885115 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.015969038 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.016216040 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.016273022 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.071273088 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.071290016 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.121450901 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.150125980 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.156991005 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.157006025 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.157341003 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.157411098 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.157949924 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.158010006 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.158181906 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.158233881 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.213079929 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:06.213087082 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:06.261221886 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:12.014210939 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:12.014255047 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:12.014331102 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:12.015403986 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:12.015415907 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:12.894361973 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:12.894423008 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:12.897002935 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:12.897010088 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:12.897361994 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:12.945947886 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:13.745340109 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:13.792490959 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996526957 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996548891 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996556044 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996563911 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996587038 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996633053 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:13.996653080 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.996664047 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:13.996690035 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:13.997052908 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.997114897 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:13.997118950 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.997139931 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:13.997183084 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:14.798547983 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:14.798578978 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:14.798588991 CEST	49768	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:14.798595905 CEST	443	49768	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:16.598366022 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:16.598397017 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:16.598464966 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:16.598685026 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:16.598699093 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.205367088 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.205399036 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.205466032 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.205648899 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.205662012 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.250437975 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.250658989 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.250673056 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.251014948 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.251025915 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.251077890 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.251085997 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.251132011 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.251715899 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.252834082 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.252887011 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.253119946 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.253127098 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.352428913 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.520450115 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.520505905 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.520550966 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.520569086 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.523591995 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.523638010 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.523650885 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.529809952 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.529860020 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.529872894 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.536163092 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.536204100 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.536216974 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.542454958 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.542527914 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.542540073 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.548634052 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.548692942 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.548705101 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.555023909 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.555079937 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.555092096 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.561357021 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.561415911 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.561428070 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.611190081 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.611226082 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.611244917 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.611258984 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.611315966 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.611321926 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.616589069 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.616627932 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.616637945 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.622741938 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.622788906 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.622801065 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.628974915 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.629040956 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.629053116 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.635345936 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.635396004 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.635404110 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.641576052 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.641628981 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.641638994 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.647864103 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.647921085 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.647932053 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.654192924 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.654254913 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.654268026 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.660075903 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.660132885 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.660145044 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.665534973 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.665592909 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.665607929 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.671113968 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.671183109 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.671195984 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.676388025 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.676428080 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.676440001 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.681832075 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.681885004 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.681895018 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.687309027 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.687364101 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.687371016 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.692791939 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.692847967 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.692857027 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.701595068 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.701643944 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.701653004 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.702152967 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.702195883 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.702203035 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.706125021 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.706171989 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.706180096 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.709790945 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.709851027 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.709857941 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.713391066 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.713462114 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.713469028 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.716907978 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.716965914 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.716973066 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.720347881 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.720408916 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.720416069 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.723831892 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.723967075 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.723973989 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.727236986 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.727279902 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.727287054 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.730762959 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.730802059 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.730809927 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.734430075 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.734493017 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.734498978 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.737873077 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.737914085 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.737921953 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.741271973 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.741328955 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.741336107 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.744761944 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.744812012 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.744821072 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.748294115 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.748372078 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.748379946 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.751791954 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.751857042 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.751863956 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.755326986 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.755399942 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.755405903 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.758757114 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.758816004 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.758822918 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.762320042 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.762371063 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.762378931 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.767007113 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.767041922 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.767055988 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.769018888 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.769059896 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.769068956 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.772413015 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.772475004 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.772488117 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.775655985 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.775986910 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.775994062 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.778779984 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.778830051 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.778878927 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.778892994 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.778928041 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.781954050 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.784852028 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.784915924 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.784928083 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.784987926 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.785073996 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.785327911 CEST	49779	443	192.168.2.4	142.250.185.225
Aug 31, 2024 09:39:17.785343885 CEST	443	49779	142.250.185.225	192.168.2.4
Aug 31, 2024 09:39:17.866383076 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.866632938 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.866648912 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.867734909 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.867805958 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.869101048 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.869162083 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.869260073 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.869267941 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.946957111 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.970938921 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.970956087 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.970961094 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.970974922 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.970988035 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.970998049 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.971002102 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.971014023 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.971029043 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.971050978 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.971363068 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.971405029 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.971546888 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.972852945 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.972862959 CEST	443	49781	13.107.246.60	192.168.2.4
Aug 31, 2024 09:39:17.972904921 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:17.972918034 CEST	49781	443	192.168.2.4	13.107.246.60
Aug 31, 2024 09:39:18.103400946 CEST	49783	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:18.108323097 CEST	53	49783	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.108434916 CEST	49783	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:18.110279083 CEST	49783	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:18.110291004 CEST	49783	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:18.115041971 CEST	53	49783	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.115067005 CEST	53	49783	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.572602987 CEST	53	49783	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.629888058 CEST	49783	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:18.635122061 CEST	53	49783	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.637304068 CEST	49783	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:18.708825111 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:18.708858967 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:18.708921909 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:18.709096909 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:18.709110975 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.257909060 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.258189917 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.258222103 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.259174109 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.259227991 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.260286093 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.260340929 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.260449886 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.300503969 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.359504938 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.359519958 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.359565020 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.359590054 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.359601021 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.359616995 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.359637976 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.359654903 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.360342979 CEST	49784	443	192.168.2.4	152.195.19.97
Aug 31, 2024 09:39:19.360357046 CEST	443	49784	152.195.19.97	192.168.2.4
Aug 31, 2024 09:39:19.430810928 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:19.430880070 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:19.430929899 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:19.431675911 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:19.431729078 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:19.431766033 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.110421896 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.110445023 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.110575914 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.110773087 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.110785961 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.111118078 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.111159086 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.113513947 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.113642931 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.113656998 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.172729969 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.172746897 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.172995090 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.173319101 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.173333883 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.577718019 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.578227043 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.578248024 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.579490900 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.579780102 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.580511093 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.580564022 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.580797911 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.580805063 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.595227003 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.595489025 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.595509052 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.596422911 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.596582890 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.597331047 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.597414970 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.603193998 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.628663063 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.628937006 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.628947973 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.629786968 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.629883051 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.630759001 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.630759001 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.630811930 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.634354115 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.644517899 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.649532080 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.649548054 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.681448936 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.681456089 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.696564913 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.700896978 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.700954914 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.701035976 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.701316118 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.701328039 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.728140116 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.728218079 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.728219032 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:20.728645086 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.728645086 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:20.769418955 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.769485950 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:20.769722939 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.769829035 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:20.769835949 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:21.040621042 CEST	49789	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:21.040647984 CEST	443	49789	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:51.087196112 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:51.087218046 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:51.227811098 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:51.227827072 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:52.025470972 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:52.025516033 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:52.025584936 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:52.025962114 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:52.025978088 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:52.798080921 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:52.798170090 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:52.801651955 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:52.801660061 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:52.801994085 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:52.809287071 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:52.852504015 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.121818066 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.121872902 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.121927977 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.121956110 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.121968031 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.121998072 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.122021914 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.123035908 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.123099089 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.123109102 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.123127937 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.123143911 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.123287916 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.123387098 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.127778053 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.127791882 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:53.127820015 CEST	49791	443	192.168.2.4	40.127.169.103
Aug 31, 2024 09:39:53.127825022 CEST	443	49791	40.127.169.103	192.168.2.4
Aug 31, 2024 09:39:57.393702030 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.393745899 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.393805981 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.394002914 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.394031048 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.394078016 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.394282103 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.394294977 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.394373894 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.394382000 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.847826004 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.848510027 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.848522902 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.848797083 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.849060059 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.849121094 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.849201918 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.856193066 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.856345892 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.856365919 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.856662035 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.856889963 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.856954098 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.856955051 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.892503023 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.900497913 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.909431934 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.965917110 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.965971947 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.966017962 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.966157913 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.966170073 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.982894897 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.982942104 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.982985973 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.983205080 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.983216047 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.245986938 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.246032000 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.246123075 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.246161938 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.246187925 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.246242046 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.246330976 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.246342897 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.246434927 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.246442080 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.718332052 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.718535900 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.718548059 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.718818903 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.719050884 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.719093084 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.722261906 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.722453117 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.722475052 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.722759008 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.722994089 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.723047018 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.760385036 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.775837898 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.805305004 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:39:59.805332899 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:39:59.805386066 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:39:59.805743933 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:39:59.805761099 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.267617941 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.268045902 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:40:00.268073082 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.268404007 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.268712044 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:40:00.268769979 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.268841028 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:40:00.316493034 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.410305977 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.410348892 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:00.410476923 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:40:00.410756111 CEST	49797	443	192.168.2.4	23.55.235.170
Aug 31, 2024 09:40:00.410774946 CEST	443	49797	23.55.235.170	192.168.2.4
Aug 31, 2024 09:40:04.446073055 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:04.446077108 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:04.446105003 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:04.446105003 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.869098902 CEST	49723	80	192.168.2.4	2.19.126.163
Aug 31, 2024 09:40:06.875088930 CEST	80	49723	2.19.126.163	192.168.2.4
Aug 31, 2024 09:40:06.875154972 CEST	49723	80	192.168.2.4	2.19.126.163
Aug 31, 2024 09:40:14.624491930 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:40:14.624552965 CEST	443	49796	162.159.61.3	192.168.2.4
Aug 31, 2024 09:40:14.624609947 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:40:14.628364086 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:40:14.628429890 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:40:14.628503084 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:40:14.657965899 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.658004999 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:14.658078909 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.658137083 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.658164024 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:14.658219099 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.658468008 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.658478022 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:14.658585072 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.658592939 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.121514082 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.121766090 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.121779919 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.122060061 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.122298002 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.122350931 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.130610943 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.130760908 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.130774021 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.131055117 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.131292105 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.131366968 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.165271044 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.180877924 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:30.029972076 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:30.030047894 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:30.030189991 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:30.038100958 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:30.038170099 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:30.038228989 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:36.087622881 CEST	49766	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:40:36.087655067 CEST	443	49766	142.250.65.174	192.168.2.4
Aug 31, 2024 09:40:36.247351885 CEST	49767	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:40:36.247375965 CEST	443	49767	142.250.65.174	192.168.2.4
Aug 31, 2024 09:40:45.119874954 CEST	49799	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:45.119900942 CEST	443	49799	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:45.119924068 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:45.119947910 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:49.451675892 CEST	49760	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:49.451679945 CEST	49761	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:49.451704025 CEST	443	49761	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:49.451704025 CEST	443	49760	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:59.635653973 CEST	49796	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:40:59.635654926 CEST	49795	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:40:59.635683060 CEST	443	49795	162.159.61.3	192.168.2.4
Aug 31, 2024 09:40:59.635683060 CEST	443	49796	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 09:38:58.037043095 CEST	53	55646	1.1.1.1	192.168.2.4
Aug 31, 2024 09:38:59.236228943 CEST	60742	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:38:59.236598969 CEST	49915	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:00.390618086 CEST	53	59056	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:00.420522928 CEST	53	63023	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.635082960 CEST	61708	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.635253906 CEST	56680	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.635934114 CEST	57004	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.636095047 CEST	62797	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.636627913 CEST	51589	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.636894941 CEST	61459	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.637587070 CEST	49205	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.638050079 CEST	51082	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.641738892 CEST	53	61708	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.642246008 CEST	53	56680	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.642504930 CEST	53	57004	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.642937899 CEST	53	62797	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.643146038 CEST	53	51589	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.643522978 CEST	53	61459	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.644119978 CEST	53	49205	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.644717932 CEST	53	51082	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.689537048 CEST	58423	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.689723015 CEST	62295	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:02.696197033 CEST	53	62295	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:02.696243048 CEST	53	58423	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:03.742399931 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.066525936 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.203722000 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.203764915 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.203775883 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.203790903 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.205090046 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.207051992 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.210551023 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.210695028 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.210917950 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.211061001 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.305847883 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.305897951 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.305905104 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.305912971 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.306412935 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.306440115 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.306603909 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.306798935 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.306926966 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.400940895 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.445945024 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.446352959 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:04.542104006 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.543809891 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.543855906 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:04.622992992 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:05.004817009 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:05.004908085 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:05.100107908 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:05.100616932 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:05.100841999 CEST	443	53291	172.64.41.3	192.168.2.4
Aug 31, 2024 09:39:05.101180077 CEST	53291	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:39:05.225677013 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.526505947 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.683873892 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.683938980 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.684307098 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.689650059 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.689661026 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.689671040 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.689681053 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.689831018 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.690278053 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.691246986 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.691359997 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.691821098 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.691837072 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.698750973 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.785548925 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.785568953 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.785912037 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.786578894 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.793292999 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.793493986 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.801170111 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.801486969 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.802484035 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.807919025 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.808027029 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:05.808156013 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.837063074 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:05.902396917 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:13.607490063 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:13.607491016 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:13.703501940 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:13.745304108 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:13.745417118 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:13.753839970 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:13.790188074 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:13.873564005 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:16.590190887 CEST	60354	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:16.590390921 CEST	50481	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:16.596842051 CEST	53	60354	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:16.597884893 CEST	53	50481	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.102529049 CEST	53	60825	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:18.495537996 CEST	138	138	192.168.2.4	192.168.2.255
Aug 31, 2024 09:39:19.110789061 CEST	53	64318	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:20.103140116 CEST	54197	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:20.103367090 CEST	50583	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:20.103683949 CEST	65265	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:20.103933096 CEST	61530	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:20.109843969 CEST	53	54197	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:20.109855890 CEST	53	50583	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:20.110491037 CEST	53	61530	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:20.110547066 CEST	53	65265	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:20.163803101 CEST	50266	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:20.163803101 CEST	58404	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:39:20.171849966 CEST	53	58404	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:20.171968937 CEST	53	50266	1.1.1.1	192.168.2.4
Aug 31, 2024 09:39:34.798727036 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:34.798865080 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:34.893817902 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:34.907975912 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:34.908066988 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:34.908257961 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:34.946434975 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:34.995634079 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:34.995826960 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.028208017 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.090903997 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.105315924 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.105326891 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.105674028 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.134335041 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.230221987 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.230271101 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.231674910 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.337153912 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.352793932 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.352804899 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:35.353061914 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.380062103 CEST	61843	443	192.168.2.4	142.250.65.174
Aug 31, 2024 09:39:35.473843098 CEST	443	61843	142.250.65.174	192.168.2.4
Aug 31, 2024 09:39:57.393497944 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.702322006 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.857779026 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.857810974 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.857882977 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.857892990 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.857903957 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.858180046 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.859754086 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.859844923 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.957226992 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.957272053 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.957281113 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.957288027 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:57.957488060 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:57.957684040 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:58.054792881 CEST	443	64779	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:58.085913897 CEST	64779	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.245769024 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.556653976 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.705910921 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.705948114 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.705976963 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.705984116 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.705988884 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.706356049 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.707835913 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.707937002 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.708146095 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.708271980 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.803016901 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.803028107 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.803327084 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.803334951 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.803601027 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.803601027 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.803661108 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.803817987 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.804666996 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:39:59.897458076 CEST	443	59057	162.159.61.3	192.168.2.4
Aug 31, 2024 09:39:59.931257963 CEST	59057	443	192.168.2.4	162.159.61.3
Aug 31, 2024 09:40:05.669008017 CEST	62757	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:40:05.669148922 CEST	51430	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:40:05.675801992 CEST	53	51430	1.1.1.1	192.168.2.4
Aug 31, 2024 09:40:05.677450895 CEST	53	62757	1.1.1.1	192.168.2.4
Aug 31, 2024 09:40:05.678193092 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:05.678333044 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:05.678517103 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:05.678589106 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.089005947 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.120872021 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.128357887 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.167525053 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.182792902 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.182809114 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.182817936 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.182826042 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.183204889 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.183274984 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.221808910 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.259793043 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.276634932 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.277041912 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.371866941 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.372529030 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.372808933 CEST	443	55112	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:06.401982069 CEST	55112	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:06.416188002 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.416296959 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.761651993 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.877912998 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.884088993 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.884099960 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.884432077 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.884497881 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.884818077 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.884834051 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.884955883 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.884967089 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.902770042 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.982579947 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.982681036 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.982690096 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.982876062 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.982992887 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.996937990 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.996944904 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.997164011 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:06.997215986 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.997534037 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:06.997719049 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:07.025233984 CEST	63496	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:07.096734047 CEST	443	63496	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:14.657702923 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:14.962450981 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.104176998 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.104604959 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.104630947 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.104640007 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.104651928 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.104849100 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.106812000 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.106987000 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.107420921 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.107520103 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.202701092 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.202766895 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.203052044 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.203597069 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.203605890 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.203748941 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.204358101 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.204912901 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.205107927 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.205363989 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:15.299362898 CEST	443	62152	172.64.41.3	192.168.2.4
Aug 31, 2024 09:40:15.337327003 CEST	62152	443	192.168.2.4	172.64.41.3
Aug 31, 2024 09:40:39.733617067 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:39.733738899 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.135076046 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.189992905 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.190007925 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.190578938 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.190649033 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.190916061 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.191025019 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.191025019 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.191056013 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.207676888 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.234633923 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.234781981 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.287884951 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.288152933 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.288189888 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.288201094 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.288332939 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.288383961 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.302592039 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.302601099 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.302834988 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.303442955 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.303584099 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.303716898 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.333262920 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.333440065 CEST	49372	443	192.168.2.4	142.250.81.238
Aug 31, 2024 09:40:40.399964094 CEST	443	49372	142.250.81.238	192.168.2.4
Aug 31, 2024 09:40:40.426636934 CEST	443	49372	142.250.81.238	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 31, 2024 09:39:02.080645084 CEST	192.168.2.4	1.1.1.1	c28d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 09:38:59.236228943 CEST	192.168.2.4	1.1.1.1	0x12e3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:38:59.236598969 CEST	192.168.2.4	1.1.1.1	0x3ee8	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 31, 2024 09:39:02.635082960 CEST	192.168.2.4	1.1.1.1	0x3fc1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.635253906 CEST	192.168.2.4	1.1.1.1	0x2345	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:02.635934114 CEST	192.168.2.4	1.1.1.1	0x621d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.636095047 CEST	192.168.2.4	1.1.1.1	0x5abc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:02.636627913 CEST	192.168.2.4	1.1.1.1	0xed9f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.636894941 CEST	192.168.2.4	1.1.1.1	0x905b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:02.637587070 CEST	192.168.2.4	1.1.1.1	0x16f2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.638050079 CEST	192.168.2.4	1.1.1.1	0xf211	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:02.689537048 CEST	192.168.2.4	1.1.1.1	0x4879	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.689723015 CEST	192.168.2.4	1.1.1.1	0xdb1f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:16.590190887 CEST	192.168.2.4	1.1.1.1	0xae51	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:16.590390921 CEST	192.168.2.4	1.1.1.1	0x899d	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:20.103140116 CEST	192.168.2.4	1.1.1.1	0xa94d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.103367090 CEST	192.168.2.4	1.1.1.1	0x7aac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:20.103683949 CEST	192.168.2.4	1.1.1.1	0x7d97	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.103933096 CEST	192.168.2.4	1.1.1.1	0xb9d4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:39:20.163803101 CEST	192.168.2.4	1.1.1.1	0x6ac7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.163803101 CEST	192.168.2.4	1.1.1.1	0x674d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 09:40:05.669008017 CEST	192.168.2.4	1.1.1.1	0xff47	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:40:05.669148922 CEST	192.168.2.4	1.1.1.1	0x5bdc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 09:38:59.242958069 CEST	1.1.1.1	192.168.2.4	0x12e3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:38:59.243505955 CEST	1.1.1.1	192.168.2.4	0x3ee8	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:00.598912001 CEST	1.1.1.1	192.168.2.4	0xee44	No error (0)	shed.dual-low.s-part-0029.t-0009.t-msedge.net	s-part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:00.598912001 CEST	1.1.1.1	192.168.2.4	0xee44	No error (0)	s-part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.641738892 CEST	1.1.1.1	192.168.2.4	0x3fc1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.641738892 CEST	1.1.1.1	192.168.2.4	0x3fc1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.642246008 CEST	1.1.1.1	192.168.2.4	0x2345	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:02.642504930 CEST	1.1.1.1	192.168.2.4	0x621d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.642504930 CEST	1.1.1.1	192.168.2.4	0x621d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.642937899 CEST	1.1.1.1	192.168.2.4	0x5abc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:02.643146038 CEST	1.1.1.1	192.168.2.4	0xed9f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.643146038 CEST	1.1.1.1	192.168.2.4	0xed9f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.643522978 CEST	1.1.1.1	192.168.2.4	0x905b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:02.644119978 CEST	1.1.1.1	192.168.2.4	0x16f2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.644119978 CEST	1.1.1.1	192.168.2.4	0x16f2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.644717932 CEST	1.1.1.1	192.168.2.4	0xf211	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:02.696197033 CEST	1.1.1.1	192.168.2.4	0xdb1f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:02.696243048 CEST	1.1.1.1	192.168.2.4	0x4879	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:02.696243048 CEST	1.1.1.1	192.168.2.4	0x4879	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:16.596842051 CEST	1.1.1.1	192.168.2.4	0xae51	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:16.596842051 CEST	1.1.1.1	192.168.2.4	0xae51	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:16.597884893 CEST	1.1.1.1	192.168.2.4	0x899d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:17.203438044 CEST	1.1.1.1	192.168.2.4	0x383d	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:17.203438044 CEST	1.1.1.1	192.168.2.4	0x383d	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:17.806261063 CEST	1.1.1.1	192.168.2.4	0x1257	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:18.572602987 CEST	1.1.1.1	192.168.2.4	0xdf7a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 09:39:18.572602987 CEST	1.1.1.1	192.168.2.4	0xdf7a	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.109843969 CEST	1.1.1.1	192.168.2.4	0xa94d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.109843969 CEST	1.1.1.1	192.168.2.4	0xa94d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.109855890 CEST	1.1.1.1	192.168.2.4	0x7aac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:20.110491037 CEST	1.1.1.1	192.168.2.4	0xb9d4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:20.110547066 CEST	1.1.1.1	192.168.2.4	0x7d97	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.110547066 CEST	1.1.1.1	192.168.2.4	0x7d97	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.171849966 CEST	1.1.1.1	192.168.2.4	0x674d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:39:20.171968937 CEST	1.1.1.1	192.168.2.4	0x6ac7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:39:20.171968937 CEST	1.1.1.1	192.168.2.4	0x6ac7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:40:05.675801992 CEST	1.1.1.1	192.168.2.4	0x5bdc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 09:40:05.677450895 CEST	1.1.1.1	192.168.2.4	0xff47	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 09:40:05.677450895 CEST	1.1.1.1	192.168.2.4	0xff47	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	13.107.246.57	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:01 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 07:39:01 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 07:39:01 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T073901Z-165795675762gt5gbs4b9bazh800000004f0000000000fgg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 07:39:01 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	13.107.246.57	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 07:39:02 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 07:39:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T073902Z-16579567576pg4fvvmc18u0v4g00000004q000000000560v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 07:39:02 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-31 07:39:02 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-31 07:39:02 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-31 07:39:02 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-31 07:39:02 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49756	162.159.61.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5d50fc291912-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49757	162.159.61.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5d51092542fe-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a4 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49754	172.64.41.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5d5108e542eb-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*Pc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	172.64.41.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5d5109db334e-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 84 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49758	162.159.61.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5d514dd28c63-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dc 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49759	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:03 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 07:39:04 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=32837 Date: Sat, 31 Aug 2024 07:39:03 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	23.43.61.160	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:04 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 07:39:05 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=32823 Date: Sat, 31 Aug 2024 07:39:04 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 07:39:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	142.250.65.174	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:05 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 07:39:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 07:39:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49764	142.250.65.174	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:05 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 07:39:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 07:39:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	142.250.80.68	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:05 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 07:39:05 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 07:27:44 GMT Expires: Sun, 08 Sep 2024 07:27:44 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 681 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 07:39:05 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-31 07:39:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-31 07:39:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-31 07:39:05 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-31 07:39:05 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49768	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7cR8+8WSEcYUTgb&MD=tTGXV443 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 07:39:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0fd1ea68-ee2c-46da-b261-0e2c39feb2da MS-RequestId: b69a5236-94af-42cc-91f5-73653bec259f MS-CV: b0X3Vn8RXEmz/8qj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 07:39:13 GMT Connection: close Content-Length: 24490
2024-08-31 07:39:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-31 07:39:13 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49779	142.250.185.225	443	8372	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:17 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 07:39:17 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljtuStaDYYAGm2K1B6vhfFE1zirakEh-vcrIS-GeOVNTwoYi7TdS_6vOolLjKfcZlXpbZbs X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Fri, 30 Aug 2024 20:38:51 GMT Expires: Sat, 30 Aug 2025 20:38:51 GMT Cache-Control: public, max-age=31536000 Age: 39626 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 07:39:17 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-08-31 07:39:17 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49781	13.107.246.60	443	8372	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:17 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 07:39:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 07:39:17 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T073917Z-16579567576h9nndaeer0cv35w00000004e000000000904k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 07:39:17 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49784	152.195.19.97	443	8372	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:19 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725694757&P2=404&P3=2&P4=M0gElKNWcBASY068rVJB8BnSOBDhdMxs0Arm9S6MNrX2UnvMNIayRpTyCp9c%2bO6gKEBR%2fwhqGXsUUVQLcah5RA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: AfgiowHY10PnXpMAv3HjwO Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 07:39:19 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5016490 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sat, 31 Aug 2024 07:39:19 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-31 07:39:19 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49788	172.64.41.3	443	8372	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5dbe1f9f43bb-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 89 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49789	172.64.41.3	443	8372	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5dbe3c104291-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49790	162.159.61.3	443	8372	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 07:39:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5dbe8c544391-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49791	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:52 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7cR8+8WSEcYUTgb&MD=tTGXV443 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 07:39:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 474b7d01-db0a-4e4c-ac9d-04cfd08028a1 MS-RequestId: 3cd7bcf0-88b0-46cf-9474-b66bcd083ba7 MS-CV: Dp/paz/c8E6eLxU7.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 07:39:52 GMT Connection: close Content-Length: 30005
2024-08-31 07:39:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-31 07:39:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49793	162.159.61.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:57 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:57 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-31 07:39:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5ea70d1a7c88-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 0c 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 38 00 02 c0 43 c0 43 00 01 00 01 00 00 00 38 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 38 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet08CC8OC8k)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49792	162.159.61.3	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:39:57 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 07:39:57 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-08-31 07:39:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 07:39:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbb5ea718061821-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 07:39:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0e 0a 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 ea 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49797	23.55.235.170	443	7304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 07:40:00 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 07:40:00 UTC	331	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Date: Sat, 31 Aug 2024 07:40:00 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.65a13617.1725090000.cf0f1f8 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	03:38:53
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa30000
File size:	917'504 bytes
MD5 hash:	BAAED183EB33CA6ACA19800F393A4C1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:38:54
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:38:54
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2028,i,7254388332489969249,207253126821642680,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:38:54
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:38:55
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2688 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:38:59
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4876 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:38:59
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5316 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:39:00
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff782650000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:39:00
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7892 --field-trial-handle=2152,i,14886479101163061401,3893405171063191477,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff782650000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:39:13
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:39:13
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:39:14
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4380 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:39:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8
Imagebase:	0x7ff782650000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:39:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6228 --field-trial-handle=2436,i,3309798280241799159,9177593977893769255,262144 /prefetch:8
Imagebase:	0x7ff782650000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:39:21
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:39:21
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2084,i,7263840641758867396,8951152612680073893,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:39:29
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:39:30
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2100,i,1304964581190080565,2805568781063090699,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:39:42
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:39:43
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,1315791386614883166,3339614871798529016,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	1334
Total number of Limit Nodes:	56

Executed Functions

Function 00A4F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00A4F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A8F474
IsIconic.USER32(00000000), ref: 00A8F47D
ShowWindow.USER32(00000000,00000009), ref: 00A8F48A
SetForegroundWindow.USER32(00000000), ref: 00A8F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A8F4AA
GetCurrentThreadId.KERNEL32 ref: 00A8F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A8F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A8F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A8F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00A8F4DE
SetForegroundWindow.USER32(00000000), ref: 00A8F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A8F4F6
keybd_event.USER32(00000012,00000000), ref: 00A8F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A8F50B
keybd_event.USER32(00000012,00000000), ref: 00A8F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A8F519
keybd_event.USER32(00000012,00000000), ref: 00A8F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A8F528
keybd_event.USER32(00000012,00000000), ref: 00A8F52D
SetForegroundWindow.USER32(00000000), ref: 00A8F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00A8F557

Strings

Shell_TrayWnd, xrefs: 00A8F46F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 9bb78a5ed89befa986c57be0628c5568763464e541ed3e7cc29184fa320006f9
Instruction ID: 66623d11068d78d66e5baab2eeae31a85be8a7a9f0ff71c909728f5093b63700
Opcode Fuzzy Hash: 9bb78a5ed89befa986c57be0628c5568763464e541ed3e7cc29184fa320006f9
Instruction Fuzzy Hash: 52315471A8021CBFEB20ABF55C4AFBF7E6CEB44B60F110066F605E61D1C6B55D01AB60

Function 00A342DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00A3430D

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

GetCurrentProcess.KERNEL32(?,00ACCB64,00000000,?,?), ref: 00A34422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00A34429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00A34454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00A34466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00A34474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00A3447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00A344A0

Strings

|O, xrefs: 00A736F8
kernel32.dll, xrefs: 00A3444F
GetNativeSystemInfo, xrefs: 00A34460

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 13a1ed120ac3c13754136dbb5a0e941f792f89453d8d5ce34903c890f2498c16
Instruction ID: d10cef8ed80d8b9d4d384ec5b1b1d8b5a5483bb6cb05e5ab80ea1deb5d036807
Opcode Fuzzy Hash: 13a1ed120ac3c13754136dbb5a0e941f792f89453d8d5ce34903c890f2498c16
Instruction Fuzzy Hash: 80A1957290A2C0FFCB1DC7AD7C815957FE47B3A340F09DCA9E08597A62DA305909DB29

Function 00A342A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00A350AA,?,?,00000000,00000000), ref: 00A342B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00A350AA,?,?,00000000,00000000), ref: 00A342C9
LoadResource.KERNEL32(?,00000000,?,?,00A350AA,?,?,00000000,00000000,?,?,?,?,?,?,00A34F20), ref: 00A735BE
SizeofResource.KERNEL32(?,00000000,?,?,00A350AA,?,?,00000000,00000000,?,?,?,?,?,?,00A34F20), ref: 00A735D3
LockResource.KERNEL32(00A350AA,?,?,00A350AA,?,?,00000000,00000000,?,?,?,?,?,?,00A34F20,?), ref: 00A735E6

Strings

SCRIPT, xrefs: 00A342BF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8de3b97afd6b5ac29c013ded9ea6333aed372651aaf710dd1ed908820b8692a5
Instruction ID: 26942d125bea45043d055824e7a4d607bd75dfce8e5afdd561d7e9eceaf437b8
Opcode Fuzzy Hash: 8de3b97afd6b5ac29c013ded9ea6333aed372651aaf710dd1ed908820b8692a5
Instruction Fuzzy Hash: 81117C71200700BFDB219BAADC48FA77BBDEBCAB61F158169F41696650DB71EC018A20

Function 00A72BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00A32B6B

Part of subcall function 00A33A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B01418,?,00A32E7F,?,?,?,00000000), ref: 00A33A78

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00AF2224), ref: 00A72C10
ShellExecuteW.SHELL32(00000000,?,?,00AF2224), ref: 00A72C17

Strings

runas, xrefs: 00A72C0B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: c3a1505884869afae214f4adc060c619da9b7f128b1c23d76c0e717ceebaa851
Instruction ID: c4577c50c7d0a9235e75ed1e1677b1378e7b55e054214ec94dfe0aba782d6eab
Opcode Fuzzy Hash: c3a1505884869afae214f4adc060c619da9b7f128b1c23d76c0e717ceebaa851
Instruction Fuzzy Hash: EB11D63250C3456ACB08FF64DA56EBEBBA4AB91350F04582DF186571A2CF618A0ADB12

Function 00A9DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00A75222), ref: 00A9DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00A9DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00A9DBEE
FindClose.KERNEL32(00000000), ref: 00A9DBFA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: fe755e14b696a1c62d35edc88e1ee9031a5b73f21ffe48b4bfc4abd046c691d3
Instruction ID: d2466f8b51edd9311e138dc8ce0b72cd6700de6647df4a32edd0e5d2ae83148e
Opcode Fuzzy Hash: fe755e14b696a1c62d35edc88e1ee9031a5b73f21ffe48b4bfc4abd046c691d3
Instruction Fuzzy Hash: F1F0A93081091067CA20ABB8EC0D8AA77AC9E02334B144702F83AC20E0EBB099968696

Function 00ABAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00ABB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00ABB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00ABB1D4
_wcslen.LIBCMT ref: 00ABB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00ABB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00ABB236
_wcslen.LIBCMT ref: 00ABB332

Part of subcall function 00AA05A7: GetStdHandle.KERNEL32(000000F6), ref: 00AA05C6

_wcslen.LIBCMT ref: 00ABB34B
_wcslen.LIBCMT ref: 00ABB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00ABB3B6
GetLastError.KERNEL32(00000000), ref: 00ABB407
CloseHandle.KERNEL32(?), ref: 00ABB439
CloseHandle.KERNEL32(00000000), ref: 00ABB44A
CloseHandle.KERNEL32(00000000), ref: 00ABB45C
CloseHandle.KERNEL32(00000000), ref: 00ABB46E
CloseHandle.KERNEL32(?), ref: 00ABB4E3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 6a792ba2d8331c785ca058cad2506f67084c08636346239c116f4b430f4755ac
Instruction ID: a10104ddb8a34cd10b3f153741147cbc428f64103b1a7bc0eeba098386e3b7de
Opcode Fuzzy Hash: 6a792ba2d8331c785ca058cad2506f67084c08636346239c116f4b430f4755ac
Instruction Fuzzy Hash: 87F1BF715143009FC724EF24C991BAEBBE5BF85314F14855DF8998B2A2CB71EC44CB62

Function 00A3D730 Relevance: 21.6, APIs: 14, Instructions: 616windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00A3D807
timeGetTime.WINMM ref: 00A3DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A3DB28
TranslateMessage.USER32(?), ref: 00A3DB7B
DispatchMessageW.USER32(?), ref: 00A3DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A3DB9F
Sleep.KERNELBASE(0000000A), ref: 00A3DBB1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 8bca773a0c067862bde32a11c2c02808900e389edb9a8bb224907d4f2a42b512
Instruction ID: 16100fc05b720c45c2af3f19c24db7ca9975624bd10ec7dabe22042bcdb5ca37
Opcode Fuzzy Hash: 8bca773a0c067862bde32a11c2c02808900e389edb9a8bb224907d4f2a42b512
Instruction Fuzzy Hash: 0F42BD70608341EFD728DF24D988BBABBE4BF85314F148A59F4A687291D770E845CB92

Function 00A32CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A32D07
RegisterClassExW.USER32(00000030), ref: 00A32D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A32D42
InitCommonControlsEx.COMCTL32(?), ref: 00A32D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A32D6F
LoadIconW.USER32(000000A9), ref: 00A32D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A32D94

Strings

0, xrefs: 00A32CE9
TaskbarCreated, xrefs: 00A32D37
+, xrefs: 00A32CF0
AutoIt v3 GUI, xrefs: 00A32D23

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e55f0ed0f63f7f7d50dacc560c95f90945444777d98bd4264c43a9e6e9ed2f33
Instruction ID: ce2b8de4482d8b423843116af4530f6104121302efe09d8d681043f3a38a377c
Opcode Fuzzy Hash: e55f0ed0f63f7f7d50dacc560c95f90945444777d98bd4264c43a9e6e9ed2f33
Instruction Fuzzy Hash: 4A21B2B5D01318AFDB00DFE8EC49B9DBBB8FB08710F01451AF615A72A0DBB145468F95

Function 00A7065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A7039A: CreateFileW.KERNELBASE(00000000,00000000,?,00A70704,?,?,00000000,?,00A70704,00000000,0000000C), ref: 00A703B7

GetLastError.KERNEL32 ref: 00A7076F
__dosmaperr.LIBCMT ref: 00A70776
GetFileType.KERNELBASE(00000000), ref: 00A70782
GetLastError.KERNEL32 ref: 00A7078C
__dosmaperr.LIBCMT ref: 00A70795
CloseHandle.KERNEL32(00000000), ref: 00A707B5
CloseHandle.KERNEL32(?), ref: 00A708FF
GetLastError.KERNEL32 ref: 00A70931
__dosmaperr.LIBCMT ref: 00A70938

Strings

H, xrefs: 00A708BD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: da3f0f4001e5dda17288d55c99d8b8b093379d9d5dd543bd74634ba9e6867695
Instruction ID: 518ae976c7f91890e4d6f1c5ae539805a5fb275fa730a78eb89680915de8c3ae
Opcode Fuzzy Hash: da3f0f4001e5dda17288d55c99d8b8b093379d9d5dd543bd74634ba9e6867695
Instruction Fuzzy Hash: 4FA11232A101498FDF19EF68DC51BAE7BB0AB16320F14815DF81A9F392DB319812CB91

Function 00A3344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A33A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B01418,?,00A32E7F,?,?,?,00000000), ref: 00A33A78

Part of subcall function 00A33357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A33379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00A3356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00A7318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00A731CE
RegCloseKey.ADVAPI32(?), ref: 00A73210
_wcslen.LIBCMT ref: 00A73277
_wcslen.LIBCMT ref: 00A73286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00A33560
\Include\, xrefs: 00A33527
Include, xrefs: 00A73184, 00A731C5
\, xrefs: 00A7328C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: a4d1b67b8fe45627c1fe06123883f6ab4fbc77ffe3b945d7941cfbfe1c67886a
Instruction ID: e057066d263ddf8e683dbe0dd30ce60081c58e9719687313045e4a817e0ddddd
Opcode Fuzzy Hash: a4d1b67b8fe45627c1fe06123883f6ab4fbc77ffe3b945d7941cfbfe1c67886a
Instruction Fuzzy Hash: 6F71B4724043009EC704EF65DD869ABBBE8FFA4350F40482EF549971A1EF749A4CCB56

Function 00A32B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A32B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00A32B9D
LoadIconW.USER32(00000063), ref: 00A32BB3
LoadIconW.USER32(000000A4), ref: 00A32BC5
LoadIconW.USER32(000000A2), ref: 00A32BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00A32BEF
RegisterClassExW.USER32(?), ref: 00A32C40

Part of subcall function 00A32CD4: GetSysColorBrush.USER32(0000000F), ref: 00A32D07
Part of subcall function 00A32CD4: RegisterClassExW.USER32(00000030), ref: 00A32D31
Part of subcall function 00A32CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A32D42
Part of subcall function 00A32CD4: InitCommonControlsEx.COMCTL32(?), ref: 00A32D5F
Part of subcall function 00A32CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A32D6F
Part of subcall function 00A32CD4: LoadIconW.USER32(000000A9), ref: 00A32D85
Part of subcall function 00A32CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A32D94

Strings

0, xrefs: 00A32C0F
#, xrefs: 00A32C16
AutoIt v3, xrefs: 00A32C2F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 2ed193f708c6df50d89efecdb1f630d96f6b71e77336a54e0fe1a35f3a5b90e7
Instruction ID: 1c95f1528496a6cfee61ec7ea741dddb55ab726b2c5c1e74d90fba060a387c80
Opcode Fuzzy Hash: 2ed193f708c6df50d89efecdb1f630d96f6b71e77336a54e0fe1a35f3a5b90e7
Instruction Fuzzy Hash: B1210771E00318BBDB18DFA9EC59AA97FF4FB58B50F04041AF505A76A0DBB14541CF98

Function 00A33170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00A3316A,?,?), ref: 00A331D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00A3316A,?,?), ref: 00A33204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A33227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00A3316A,?,?), ref: 00A33232
CreatePopupMenu.USER32 ref: 00A33246
PostQuitMessage.USER32(00000000), ref: 00A33267

Strings

TaskbarCreated, xrefs: 00A3322D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 3bdf5ef24d1a46630dc4057d0ce27742855dffb390308aa9ed5c16a69b2bcd94
Instruction ID: 04fceb19156d2f5e94928fc97db46edf55509ed15a218608871efad9919524c6
Opcode Fuzzy Hash: 3bdf5ef24d1a46630dc4057d0ce27742855dffb390308aa9ed5c16a69b2bcd94
Instruction Fuzzy Hash: 75413933648200BBDF185BBC9D0DBBE3B69EB25350F048625F60A872E1DF718E4197A5

Function 00A32C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00A32C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00A32CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00A31CAD,?), ref: 00A32CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00A31CAD,?), ref: 00A32CCF

Strings

AutoIt v3, xrefs: 00A32C89, 00A32C8E, 00A32C8F
edit, xrefs: 00A32CAC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 1a1d1f48c54375e2d7b6917c805162f1d03697864fe913d7a58de80a8c549fb4
Instruction ID: 2701f6c5434746ccf53c3079021e647270e577f00c78258a963b8f3b07b787d0
Opcode Fuzzy Hash: 1a1d1f48c54375e2d7b6917c805162f1d03697864fe913d7a58de80a8c549fb4
Instruction Fuzzy Hash: C6F05E755403907AEB30071BAC08F773EBDD7D6F60F01041EF904A35A0DA710841DAB8

Function 00A9E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00A9E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00A9E9A5
Sleep.KERNEL32(00000000), ref: 00A9E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00A9E9B7
Sleep.KERNELBASE ref: 00A9E9F3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 325dd7292320362c224757b0be58dbfc18ec41062eb9b1eb78290d33f9b9fd1c
Instruction ID: bf5d89c6f69b1b9c2eeb4145712041032bcf955a7f2468c996d98eccc5f489c8
Opcode Fuzzy Hash: 325dd7292320362c224757b0be58dbfc18ec41062eb9b1eb78290d33f9b9fd1c
Instruction Fuzzy Hash: 34015B31D01539DBCF00EBE5DC59ADDFBB8FB08310F050646E506B2142CB30995287A1

Function 00A33B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00A33B0F,SwapMouseButtons,00000004,?), ref: 00A33B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00A33B0F,SwapMouseButtons,00000004,?), ref: 00A33B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00A33B0F,SwapMouseButtons,00000004,?), ref: 00A33B83

Strings

Control Panel\Mouse, xrefs: 00A33B3E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: d48ee9382e323b044a470425cafcd68347427f3be7202cbdf5d77e2b370561e1
Instruction ID: ac1c93e7d8132a7b76fcf8b99423779e83be3b6127b8be7e7157f81c410dc383
Opcode Fuzzy Hash: d48ee9382e323b044a470425cafcd68347427f3be7202cbdf5d77e2b370561e1
Instruction Fuzzy Hash: 10112AB6514208FFDF20CFA5DC44EAEB7B8EF04754F104459F806D7110E2719E419760

Function 00A33923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00A733A2

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A33A04

Strings

Line: , xrefs: 00A733EB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 3c5ddc06692f259539d80dab53e1bd6895abb9c44aed2bc65a2807759bc9114a
Instruction ID: ecf448c25cf6d2ba7074a59809463dab3af3e9b50d3ab6adb47ac9b84536dc35
Opcode Fuzzy Hash: 3c5ddc06692f259539d80dab53e1bd6895abb9c44aed2bc65a2807759bc9114a
Instruction Fuzzy Hash: CC31B27240C304AECB25EB24DC45BEBB7E8AB54714F00892EF59997091EF709A49C7C6

Function 00A4FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00A50668

Part of subcall function 00A532A4: RaiseException.KERNEL32(?,?,?,00A5068A,?,00B01444,?,?,?,?,?,?,00A5068A,00A31129,00AF8738,00A31129), ref: 00A53304

__CxxThrowException@8.LIBVCRUNTIME ref: 00A50685

Strings

Unknown exception, xrefs: 00A50692

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: c003f5252862ff3ddb3690e081c82456ab2eac92d1db83c47d832903937f6668
Instruction ID: eb45d6316092aa66c1158dab63148d8d0fdbd28641c419b71df59b61445e7a28
Opcode Fuzzy Hash: c003f5252862ff3ddb3690e081c82456ab2eac92d1db83c47d832903937f6668
Instruction Fuzzy Hash: 4CF0C23490060D7BCF00BBA4D946D9E776C7E80355B604531BD14D6992EFB1DA6DC590

Function 00A310F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A31BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00A31BF4
Part of subcall function 00A31BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00A31BFC
Part of subcall function 00A31BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00A31C07
Part of subcall function 00A31BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00A31C12
Part of subcall function 00A31BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00A31C1A
Part of subcall function 00A31BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00A31C22

Part of subcall function 00A31B4A: RegisterWindowMessageW.USER32(00000004,?,00A312C4), ref: 00A31BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00A3136A
OleInitialize.OLE32 ref: 00A31388
CloseHandle.KERNEL32(00000000,00000000), ref: 00A724AB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 4affea0ee4bc8c229ebc708b6f0b99cbc1aa3ca1938f283977626c63fbb0265c
Instruction ID: dc3b8923a37744fe81719c099bf9afba8648c58f1fd0817f3da8f53f2a255217
Opcode Fuzzy Hash: 4affea0ee4bc8c229ebc708b6f0b99cbc1aa3ca1938f283977626c63fbb0265c
Instruction Fuzzy Hash: 4471A7B99113008EC38CEF7DAD45A593AE4BBB8354B548A6EE44ADB3B1EF308501CF50

Function 00A9C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A33923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A33A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A9C259
KillTimer.USER32(?,00000001,?,?), ref: 00A9C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A9C270

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 4bb4dcf665d2f046f2ece86e6443f7b2f71edae80796dee4eddeaf61fd7d155c
Instruction ID: 75daae220d7c34af543ccb6030c93d3c55d2cedc979b98f1a3d82f68576faee2
Opcode Fuzzy Hash: 4bb4dcf665d2f046f2ece86e6443f7b2f71edae80796dee4eddeaf61fd7d155c
Instruction Fuzzy Hash: 5531C370A04784AFEF22DF648895BE7BBFCAB06318F00449AD5DE97241C7745A85CB51

Function 00A686AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00A685CC,?,00AF8CC8,0000000C), ref: 00A68704
GetLastError.KERNEL32(?,00A685CC,?,00AF8CC8,0000000C), ref: 00A6870E
__dosmaperr.LIBCMT ref: 00A68739

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 18f7f9d4908a04d08058b7923704f21e4cbd78fbf96a92a663508d0f29694421
Instruction ID: bca22c5e6c5b5255f80f1c37a705d1683d3d7e2a651e24f9b427fd6fbe16676e
Opcode Fuzzy Hash: 18f7f9d4908a04d08058b7923704f21e4cbd78fbf96a92a663508d0f29694421
Instruction Fuzzy Hash: D3014936A056602AD634A334E945B7E677D4B92F74F390319F9198F2D2DEB8CC819190

Function 00A3DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00A3DB7B
DispatchMessageW.USER32(?), ref: 00A3DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A3DB9F
Sleep.KERNELBASE(0000000A), ref: 00A3DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00A81CC9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 219e16993a2a71388c19839811a1935a486736d713cdaf54176bb7a909cdf982
Instruction ID: c6fa881c9cc298bb6d03ec30e5984c045f88b28388b52affbc26e46b1987e542
Opcode Fuzzy Hash: 219e16993a2a71388c19839811a1935a486736d713cdaf54176bb7a909cdf982
Instruction Fuzzy Hash: 3FF0FE71644344DBEB34DBA4DC89FAA77BCEB85310F104919F65A930D0DB30A5499B25

Function 00A41310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00A417F6

Strings

CALL, xrefs: 00A417C6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: d9bb6174abe8f8e9979023bbcc2efa86a6e7976fd3cf28e06a4160807834ee42
Instruction ID: a40992f826080eb8bf5102fea8cbe818420948c3cca0b9c7850cece731e1d7b9
Opcode Fuzzy Hash: d9bb6174abe8f8e9979023bbcc2efa86a6e7976fd3cf28e06a4160807834ee42
Instruction Fuzzy Hash: 422279786082019FD714DF14C984B2ABBF1BFC9314F24896DF4968B3A2D771E885CB92

Function 00A32DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00A72C8C

Part of subcall function 00A33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A33A97,?,?,00A32E7F,?,?,?,00000000), ref: 00A33AC2

Part of subcall function 00A32DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00A32DC4

Strings

X, xrefs: 00A72C5A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 9a49cd0a8f51cf95b53e0e94ba198f1659210d1cc8fb179320cb5456da2696ee
Instruction ID: f40c21f1d21deb3c659886e53f4f01500d9e20b742483a834ed4c90e987a755f
Opcode Fuzzy Hash: 9a49cd0a8f51cf95b53e0e94ba198f1659210d1cc8fb179320cb5456da2696ee
Instruction Fuzzy Hash: 0C219371A002589FCB01EF94C949BEE7BF8AF49315F008059F509A7241DBB45A898FA1

Function 00A33837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A33908

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 6fcd52eb5069234a593eeba7645023ecb89f457e0c4620399b08760b15ebdba7
Instruction ID: 2a5d416d8669d8884c7a2f4732902f55e448b2ec7af1ede16f4415e942b47d5f
Opcode Fuzzy Hash: 6fcd52eb5069234a593eeba7645023ecb89f457e0c4620399b08760b15ebdba7
Instruction Fuzzy Hash: A7319171608701DFDB20DF64D98479BBBE8FB49719F00092EF59A87280E771AA44CB92

Function 00A4F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A4F661

Part of subcall function 00A3D730: GetInputState.USER32 ref: 00A3D807

Sleep.KERNEL32(00000000), ref: 00A8F2DE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: d73cba30060287e544d26ded972be01cda15f21ba30f29f54e7417ad9ef291fa
Instruction ID: 9fa4fb15e2f76fb96f2a15e49ad9cd680616b7483e99d85acf417538d67cbbf4
Opcode Fuzzy Hash: d73cba30060287e544d26ded972be01cda15f21ba30f29f54e7417ad9ef291fa
Instruction Fuzzy Hash: ABF08C312402059FD350EF69D549F6ABBE9EF45760F000029F85EC7260DB70A800CBA0

Function 00A3B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00A3BB4E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 91d940b2afe0111b029f3be16c6a40e990a89068607ad3f95ec26d342137885c
Instruction ID: dd288b78f69afdd74e8c151f83e19bc133f874edd1e46e97a04d0dabed2dcd64
Opcode Fuzzy Hash: 91d940b2afe0111b029f3be16c6a40e990a89068607ad3f95ec26d342137885c
Instruction Fuzzy Hash: 3132AB34A00209DFDB24DF58C998FBAB7BAEF44310F148059FA15AB2A1D774ED45CBA1

Function 00AC2598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00AC2649

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: f0384e82bb54a1cdd23f11ea5f9406ddf31a8ca9220074a060fcdc9e3218ca2d
Instruction ID: cf3810e0208b70f0526e76a754adb853af158cff2693c3de3f1c062b4742c09f
Opcode Fuzzy Hash: f0384e82bb54a1cdd23f11ea5f9406ddf31a8ca9220074a060fcdc9e3218ca2d
Instruction Fuzzy Hash: 8521C274200219AFE710DF18C8D0F37B7A9EF44368B15806CE8968B392DB71ED41CBA0

Function 00AC13B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00AC1420

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 640031af6cae98e8fee47b15715a3b22ef00e39ffffb58d92a14bfaf3181c0d2
Instruction ID: 082326275426e5525dec6b121f0e0df4a491effc7e07f9db481ca800bffe32c7
Opcode Fuzzy Hash: 640031af6cae98e8fee47b15715a3b22ef00e39ffffb58d92a14bfaf3181c0d2
Instruction Fuzzy Hash: 83316D74704202AFD718EF29C595F69B7A2FF45328F15816CE8164B292DB31EC51CB90

Function 00A34ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A34E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A34EDD,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34E9C
Part of subcall function 00A34E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A34EAE
Part of subcall function 00A34E90: FreeLibrary.KERNEL32(00000000,?,?,00A34EDD,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34EFD

Part of subcall function 00A34E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A73CDE,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34E62
Part of subcall function 00A34E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A34E74
Part of subcall function 00A34E59: FreeLibrary.KERNEL32(00000000,?,?,00A73CDE,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34E87

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 2f9175cee4b1418129ddeb04d4f5cdc5b10272d20580ccac3e0e60e2d35fb392
Instruction ID: da569b2ddda1cc9d93f79de61f35c88825e2c955cad6064f52cae49a6c3e668c
Opcode Fuzzy Hash: 2f9175cee4b1418129ddeb04d4f5cdc5b10272d20580ccac3e0e60e2d35fb392
Instruction Fuzzy Hash: 3A11E332600305AACF18FBB4DE02FED77A5AF48B11F24842DF546A61C1EE74AA099B50

Function 00A68402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00A68440

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: bcff91c1ae48a645a419bf5ccfd115ac9280cedadee011958d87fddf042a2842
Instruction ID: c51a656d03c92643c5e2cb872eddb049629baed5b961b27bbc328168b587df5b
Opcode Fuzzy Hash: bcff91c1ae48a645a419bf5ccfd115ac9280cedadee011958d87fddf042a2842
Instruction Fuzzy Hash: 8811187590410AAFCB05DF58E945A9A7BF9EF48314F108199F808AB312DA31DA11CBA5

Function 00AC29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00AC14B5,?), ref: 00AC2A01

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 7966c52891d6a34232b87d194738c294f18cc437c6c12ef43f0159e5cc9c076b
Instruction ID: faca6ca92436dd746978cdeeee0c9edba3a8b0d4bea8448f1f2ed06c13b773c0
Opcode Fuzzy Hash: 7966c52891d6a34232b87d194738c294f18cc437c6c12ef43f0159e5cc9c076b
Instruction Fuzzy Hash: 1C017136740A41AFD335CB2DC454F2677A2EB85354F6A856DD05B8B251DB32EC42C7A0

Function 00A5E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 1f338b71070755820799b8c78c0f51e87c2062026586d75bca510f148c95c2a2
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 14F02832511E109AD7357B79CE05B5A33ADBFA23B3F100B15FC21935D2CB74D90A86A5

Function 00AC149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00AC14EB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: fde5fc6c7123d9f2642a932cd5dc02f1406f72237b8a4925360d51383539a860
Instruction ID: a79f842a0533bf78ed7cbe3ba4572d7ea5576bdd9b5a11ec251dcfa0ab06db1d
Opcode Fuzzy Hash: fde5fc6c7123d9f2642a932cd5dc02f1406f72237b8a4925360d51383539a860
Instruction Fuzzy Hash: E801DF753047419FD324DFAAC940E26BBA5FF8636475680ADE84A8B743D632DD82CBC0

Function 00A63820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00B01444,?,00A4FDF5,?,?,00A3A976,00000010,00B01440,00A313FC,?,00A313C6,?,00A31129), ref: 00A63852

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8a92b021aa567b7a551b3e084acd36a14ae338ed43c0b33bf94ce5ea98f6c0e7
Instruction ID: e04755c5f48f80a11f0eecaeb04d458c060af5f1edaca80f3a45b95067ef613b
Opcode Fuzzy Hash: 8a92b021aa567b7a551b3e084acd36a14ae338ed43c0b33bf94ce5ea98f6c0e7
Instruction Fuzzy Hash: 77E06533102324AAEE212BB79D05BDA3679AB427B1F150121BD15975D1DB21DD0382E1

Function 00A34F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34F6D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b59b910bf148b9b60351285bf00c0d3d7a9bda91d5fc6987301fff42a12ea264
Instruction ID: 8d55925f86f7426d5dcc39e0100d6c768d1f6ce599c24e584af1d673e85e1c28
Opcode Fuzzy Hash: b59b910bf148b9b60351285bf00c0d3d7a9bda91d5fc6987301fff42a12ea264
Instruction Fuzzy Hash: 17F03971105752CFDB389F65D590822BBF4FF187297288ABEF1EA82621C731A848DF10

Function 00AC2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00AC2A66

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 9a0027dbe2ca6332327824087d13fa0e8dae5d0930b339e520496a3d57f17e73
Instruction ID: 2ca4035dda44c7be7c2ee902edeb2e22c43e3ea0c53de9f94274c8fde8be665f
Opcode Fuzzy Hash: 9a0027dbe2ca6332327824087d13fa0e8dae5d0930b339e520496a3d57f17e73
Instruction Fuzzy Hash: FEE04F36354116AACB14EB34DD80EFA73ACEF543D5B11453AEC1AC6140DB30999697A0

Function 00A32DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00A32DC4

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: cea98dfca1685a0dab129926fb01a32d0973e5516d5d5c843a21c7da9b587ca5
Instruction ID: 8709826ccaa840a02c6d04573a41b20664a2e8ae21457b45c6d9530279e63974
Opcode Fuzzy Hash: cea98dfca1685a0dab129926fb01a32d0973e5516d5d5c843a21c7da9b587ca5
Instruction Fuzzy Hash: 6DE0CD72A001246BC710E7989C05FDA77DDDFC8790F054071FD0DD7248E960AD808650

Function 00A32B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A33837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A33908

Part of subcall function 00A3D730: GetInputState.USER32 ref: 00A3D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00A32B6B

Part of subcall function 00A330F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00A3314E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 3f65365f601a139bd26686e12b4fd24927bd0208708f986d38e2d61b128a1c67
Instruction ID: 3d670311dd4fdd9929f87c160d18e1290cdb0aebe947fc8b6c040db7cddf4da1
Opcode Fuzzy Hash: 3f65365f601a139bd26686e12b4fd24927bd0208708f986d38e2d61b128a1c67
Instruction Fuzzy Hash: 00E0CD3370824407CE0CFB74A95257DF7599BD1361F40197EF146472B3CF6485454752

Function 00A93D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A93D18

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 178f2a757af4bf3676c5d158f43a19f41095234d82b4e92ddaa2ce6535868aff
Instruction ID: e632d533aa595a25e0fbb6a914b2220c0b6a8aa18f72c6c00cf8b76b2660d6d7
Opcode Fuzzy Hash: 178f2a757af4bf3676c5d158f43a19f41095234d82b4e92ddaa2ce6535868aff
Instruction Fuzzy Hash: C6D08CF0AA0308BEFB0083B18D0BEBB339CC316E85F004BA4BE02D64C1D9A0DE090230

Function 00A7039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00A70704,?,?,00000000,?,00A70704,00000000,0000000C), ref: 00A703B7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9d268919ccfe51941c5d87c0070fa9309df925cccfd0dc00a9018af19c2a3037
Instruction ID: a684e3f17b62faaefc5ac8b813d82e4c689da8fa5479adf0442f53b11bc74a8b
Opcode Fuzzy Hash: 9d268919ccfe51941c5d87c0070fa9309df925cccfd0dc00a9018af19c2a3037
Instruction Fuzzy Hash: 6ED06C3204010DBBDF028F85DD06EDA3BAAFB48714F014100FE1856020C732E822AB90

Function 00A31CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00A31CBC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 88d96584f53568c448fbaed27e6b7be55c06f01b9740567995cd84a276fcd926
Instruction ID: 4f7a8e3b77412b0a0693c92ccbfaf70c8d308f5988cedb3273d22b4d397b5f10
Opcode Fuzzy Hash: 88d96584f53568c448fbaed27e6b7be55c06f01b9740567995cd84a276fcd926
Instruction Fuzzy Hash: 85C092362C0308AFF3188BC4BC4FF107764A368B10F048401F60DAA5E3CBA22822EA58

Non-executed Functions

Function 00AC9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00AC961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00AC965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00AC969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00AC96C9
SendMessageW.USER32 ref: 00AC96F2
GetKeyState.USER32(00000011), ref: 00AC978B
GetKeyState.USER32(00000009), ref: 00AC9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00AC97AE
GetKeyState.USER32(00000010), ref: 00AC97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00AC97E9
SendMessageW.USER32 ref: 00AC9810
SendMessageW.USER32(?,00001030,?,00AC7E95), ref: 00AC9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00AC992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00AC9941
SetCapture.USER32(?), ref: 00AC994A
ClientToScreen.USER32(?,?), ref: 00AC99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00AC99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00AC99D6
ReleaseCapture.USER32 ref: 00AC99E1
GetCursorPos.USER32(?), ref: 00AC9A19
ScreenToClient.USER32(?,?), ref: 00AC9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00AC9A80
SendMessageW.USER32 ref: 00AC9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00AC9AEB
SendMessageW.USER32 ref: 00AC9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00AC9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00AC9B4A
GetCursorPos.USER32(?), ref: 00AC9B68
ScreenToClient.USER32(?,?), ref: 00AC9B75
GetParent.USER32(?), ref: 00AC9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00AC9BFA
SendMessageW.USER32 ref: 00AC9C2B
ClientToScreen.USER32(?,?), ref: 00AC9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00AC9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00AC9CDE
SendMessageW.USER32 ref: 00AC9D01
ClientToScreen.USER32(?,?), ref: 00AC9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00AC9D82

Part of subcall function 00A49944: GetWindowLongW.USER32(?,000000EB), ref: 00A49952

GetWindowLongW.USER32(?,000000F0), ref: 00AC9E05

Strings

@GUI_DRAGID, xrefs: 00AC997D
F, xrefs: 00AC9D07

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 96f45b8799e9683748e1237c47f4207685a60a4d22192fbf1a1d92dbe1d3ecf0
Instruction ID: b71e325c5b4363cd6b983381d2ab6833dff7a99a9f6e609b9894247eabdd8fdc
Opcode Fuzzy Hash: 96f45b8799e9683748e1237c47f4207685a60a4d22192fbf1a1d92dbe1d3ecf0
Instruction Fuzzy Hash: B9427A35204201AFDB25CF68CD48FABBBE5FF48320F120A1DF699972A1D731A961CB51

Function 00AC4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00AC48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00AC4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00AC4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00AC494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00AC495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00AC497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00AC49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00AC49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00AC4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00AC4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00AC4A7E
IsMenu.USER32(?), ref: 00AC4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00AC4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00AC4B20
GetWindowLongW.USER32(?,000000F0), ref: 00AC4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00AC4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00AC4C82
wsprintfW.USER32 ref: 00AC4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00AC4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00AC4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00AC4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00AC4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00AC4D5A

Strings

%d/%02d/%02d, xrefs: 00AC4CA8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 73d95f16cfdc756633fbded58cd834d1159728196abf32d6d1e64630c4d615db
Instruction ID: c8fa5fa367e2e0a6557c9f2c9e00cb707ba018486541e47776d370b30995a30e
Opcode Fuzzy Hash: 73d95f16cfdc756633fbded58cd834d1159728196abf32d6d1e64630c4d615db
Instruction Fuzzy Hash: 6F121F31600214ABEB258F68CD59FAE7BF8EF48710F11412DF51AEB2E0DB789941CB54

Function 00A91201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00A916C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A9170D
Part of subcall function 00A916C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A9173A
Part of subcall function 00A916C3: GetLastError.KERNEL32 ref: 00A9174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00A91286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00A912A8
CloseHandle.KERNEL32(?), ref: 00A912B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A912D1
GetProcessWindowStation.USER32 ref: 00A912EA
SetProcessWindowStation.USER32(00000000), ref: 00A912F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A91310

Part of subcall function 00A910BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A911FC), ref: 00A910D4
Part of subcall function 00A910BF: CloseHandle.KERNEL32(?,?,00A911FC), ref: 00A910E9

Strings

default, xrefs: 00A9130B
winsta0, xrefs: 00A912CC
, xrefs: 00A9125A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 9fd3986b88a072941e198c3c877de8f3fe7d6683932b84c37f7b46858e1f5d48
Instruction ID: 65799634f90a482a9916f90867101e3e203a5a38e025872a923cb8d3c1cac22a
Opcode Fuzzy Hash: 9fd3986b88a072941e198c3c877de8f3fe7d6683932b84c37f7b46858e1f5d48
Instruction Fuzzy Hash: 32819FB1A0020AAFEF11DFA8DD49FEE7BF9EF48714F144129FA15A61A0D7318945CB20

Function 00A90B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A910F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A91114
Part of subcall function 00A910F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A91120
Part of subcall function 00A910F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A9112F
Part of subcall function 00A910F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A91136
Part of subcall function 00A910F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A9114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A90BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A90C00
GetLengthSid.ADVAPI32(?), ref: 00A90C17
GetAce.ADVAPI32(?,00000000,?), ref: 00A90C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A90C6D
GetLengthSid.ADVAPI32(?), ref: 00A90C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A90C8C
HeapAlloc.KERNEL32(00000000), ref: 00A90C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A90CB4
CopySid.ADVAPI32(00000000), ref: 00A90CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A90CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A90D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A90D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A90D45
HeapFree.KERNEL32(00000000), ref: 00A90D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A90D55
HeapFree.KERNEL32(00000000), ref: 00A90D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A90D65
HeapFree.KERNEL32(00000000), ref: 00A90D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A90D78
HeapFree.KERNEL32(00000000), ref: 00A90D7F

Part of subcall function 00A91193: GetProcessHeap.KERNEL32(00000008,00A90BB1,?,00000000,?,00A90BB1,?), ref: 00A911A1
Part of subcall function 00A91193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A90BB1,?), ref: 00A911A8
Part of subcall function 00A91193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A90BB1,?), ref: 00A911B7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c784711f099f3db7ad12fc1f0d7444f384937f9814125467d34b3340739e91c7
Instruction ID: 40c6772bd2ee2f3c242bd098a2c3df923d9de2f7fc13c8ca7b42decf1101063a
Opcode Fuzzy Hash: c784711f099f3db7ad12fc1f0d7444f384937f9814125467d34b3340739e91c7
Instruction Fuzzy Hash: BB717B72A0021AEFDF10DFE5DC44FAEBBBCBF04354F054615E918A6291DB71A906CBA0

Function 00AAEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00ACCC08), ref: 00AAEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00AAEB37
GetClipboardData.USER32(0000000D), ref: 00AAEB43
CloseClipboard.USER32 ref: 00AAEB4F
GlobalLock.KERNEL32(00000000), ref: 00AAEB87
CloseClipboard.USER32 ref: 00AAEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00AAEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00AAEBC9
GetClipboardData.USER32(00000001), ref: 00AAEBD1
GlobalLock.KERNEL32(00000000), ref: 00AAEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00AAEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00AAEC38
GetClipboardData.USER32(0000000F), ref: 00AAEC44
GlobalLock.KERNEL32(00000000), ref: 00AAEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00AAEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00AAEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00AAECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00AAECF3
CountClipboardFormats.USER32 ref: 00AAED14
CloseClipboard.USER32 ref: 00AAED59

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: cec39d941a858a19149c1b0655344d241b040ed88e44194cb1621f6c95447064
Instruction ID: 0eb7155e1fe4e89ee605e315b86dc08cbf3789fed24a7283767de8438fce2168
Opcode Fuzzy Hash: cec39d941a858a19149c1b0655344d241b040ed88e44194cb1621f6c95447064
Instruction Fuzzy Hash: 8361DF35204301AFD300EF64D988F6AB7E8AF85724F15851DF45A9B2E2CB71DD46CBA2

Function 00AA698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AA69BE
FindClose.KERNEL32(00000000), ref: 00AA6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AA6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AA6A75

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00AA6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00AA6ADF

Strings

%03d, xrefs: 00AA6DA2
%4d, xrefs: 00AA6BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00AA6B32
%02d, xrefs: 00AA6C00, 00AA6C0A, 00AA6C5A, 00AA6CAA, 00AA6CFA, 00AA6D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00AA6B6A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 249822d4e7079f1eb27c39dd3f1c734999143cf527ca758874d4a4de3fddf004
Instruction ID: 4c40d36e5144d0bfe89136b8706aaff09b46a5a8fe6b0164970d2cf9e4da54b4
Opcode Fuzzy Hash: 249822d4e7079f1eb27c39dd3f1c734999143cf527ca758874d4a4de3fddf004
Instruction Fuzzy Hash: 1FD15EB2508300AFC714EBA4C985EAFB7ECAF89704F44491DF589D7191EB74DA44CB62

Function 00AA9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00AA9663
GetFileAttributesW.KERNEL32(?), ref: 00AA96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00AA96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00AA96D3
FindClose.KERNEL32(00000000), ref: 00AA96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00AA96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA974A
SetCurrentDirectoryW.KERNEL32(00AF6B7C), ref: 00AA9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00AA9772
FindClose.KERNEL32(00000000), ref: 00AA977F
FindClose.KERNEL32(00000000), ref: 00AA978F

Strings

*.*, xrefs: 00AA96F5

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: e05f03c20beea7f14414e7b741815a4e1ac81cf78233fdc797bfc64071703151
Instruction ID: 686ff9576babbd0d90906cbebea33133c52f1d1108361c91154e59fc5ba32e76
Opcode Fuzzy Hash: e05f03c20beea7f14414e7b741815a4e1ac81cf78233fdc797bfc64071703151
Instruction Fuzzy Hash: F331C2329406197ADB14EFF4EC08EEF77ACAF4A361F114155F909E31D0EB30D9458A20

Function 00AA979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00AA97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00AA9819
FindClose.KERNEL32(00000000), ref: 00AA9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00AA9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA9890
SetCurrentDirectoryW.KERNEL32(00AF6B7C), ref: 00AA98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00AA98B8
FindClose.KERNEL32(00000000), ref: 00AA98C5
FindClose.KERNEL32(00000000), ref: 00AA98D5

Part of subcall function 00A9DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A9DB00

Strings

*.*, xrefs: 00AA983B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 121af262800dd4c15c7a2002b784bc5ba46a1f183c4f805f28c741b1e7d8626b
Instruction ID: 6b831208076c94c1143cf7b292e4763fc1ec4663e6ae138fc73af61ebf768cd0
Opcode Fuzzy Hash: 121af262800dd4c15c7a2002b784bc5ba46a1f183c4f805f28c741b1e7d8626b
Instruction Fuzzy Hash: 3B31B0325406197ADB10EFF4EC48EEF77ACAF0B360F114555E914A31D0DB38DA858B60

Function 00ABBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ABC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ABB6AE,?,?), ref: 00ABC9B5
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABC9F1
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA68
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ABBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00ABBFA9
RegCloseKey.ADVAPI32(00000000), ref: 00ABBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00ABC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00ABC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00ABC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00ABC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00ABC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00ABC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00ABC382
RegCloseKey.ADVAPI32(00000000), ref: 00ABC38F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 3d919e59724a5f9b5bbc4cb0064d61f41b9d3d82c19314d33f3f29f68d831dbc
Instruction ID: 22dc23b3be17b357295394b6ed12689f927fb99b583a43f4efff5a45f10ed094
Opcode Fuzzy Hash: 3d919e59724a5f9b5bbc4cb0064d61f41b9d3d82c19314d33f3f29f68d831dbc
Instruction Fuzzy Hash: 3C024C71604200AFD714DF28C991E6ABBE9AF89314F58849DF84ADF2A2D731EC46CB51

Function 00AA8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00AA8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00AA8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00AA8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AA8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AA838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA8395

Strings

*.*, xrefs: 00AA839B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 5fe9252341888d995dd14b44876c69463a10ebbca7b602466c37a917300f91ea
Instruction ID: 90c4204ef87b0c354076bc990ce42a2758c1098fb9de923509d6a9eb75ded0c4
Opcode Fuzzy Hash: 5fe9252341888d995dd14b44876c69463a10ebbca7b602466c37a917300f91ea
Instruction Fuzzy Hash: 6E616C725043459FCB10EF64C9409AFB3E8FF89314F04891EF99997291EB35E949CBA2

Function 00A9D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A33A97,?,?,00A32E7F,?,?,?,00000000), ref: 00A33AC2

Part of subcall function 00A9E199: GetFileAttributesW.KERNEL32(?,00A9CF95), ref: 00A9E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A9D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00A9D1DD
MoveFileW.KERNEL32(?,?), ref: 00A9D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A9D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A9D237

Part of subcall function 00A9D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00A9D21C,?,?), ref: 00A9D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00A9D253
FindClose.KERNEL32(00000000), ref: 00A9D264

Strings

\*.*, xrefs: 00A9D0CD, 00A9D0D6, 00A9D0EB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: c6816b6fd8d44415bbc009ec201662d9fda992cdb1b333f34ef813828a8e4511
Instruction ID: 7d620cf5ada958b76d5695de26f47d3ffa88a5164d630b893705bf052e6c393f
Opcode Fuzzy Hash: c6816b6fd8d44415bbc009ec201662d9fda992cdb1b333f34ef813828a8e4511
Instruction Fuzzy Hash: 3C616A31D0510DABCF05EBE0DA929EEB7B5AF55300F204169F446771A2EB31AF49CB61

Function 00AAED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00AAED91
EmptyClipboard.USER32 ref: 00AAED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00AAEDAC
CloseClipboard.USER32 ref: 00AAEEA3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 1a3bc8ea7b3cdb7a325415aecda788a0fef0fb574c0fcf504319a695f66ea1a4
Instruction ID: f8bafdcb1c7fae3f5dc2ca6ef347792db553c817f2ed1d96cd4c9ae2ff4b2761
Opcode Fuzzy Hash: 1a3bc8ea7b3cdb7a325415aecda788a0fef0fb574c0fcf504319a695f66ea1a4
Instruction Fuzzy Hash: A941BC35204611AFE720DF59D888F19BBE5FF45329F15C09DE42A8B6A2C735EC42CB90

Function 00A9E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A916C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A9170D
Part of subcall function 00A916C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A9173A
Part of subcall function 00A916C3: GetLastError.KERNEL32 ref: 00A9174A

ExitWindowsEx.USER32(?,00000000), ref: 00A9E932

Strings

SeShutdownPrivilege, xrefs: 00A9E902
, xrefs: 00A9E95C
@, xrefs: 00A9E925
, xrefs: 00A9E920

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: d5e25ce8d56e4df68316b2eaf847d0e94c55a602c5866a3ab72397a02e3aed84
Instruction ID: 56e0f759199a685066d72737bb3abe1547f1140bbbdfa3384959ad87d52f7755
Opcode Fuzzy Hash: d5e25ce8d56e4df68316b2eaf847d0e94c55a602c5866a3ab72397a02e3aed84
Instruction Fuzzy Hash: 8001F972B10215AFEF54E7B49D86FBFB2ECA714B60F150821FD13E21D3D9A15C418190

Function 00AB1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00AB1276
WSAGetLastError.WSOCK32 ref: 00AB1283
bind.WSOCK32(00000000,?,00000010), ref: 00AB12BA
WSAGetLastError.WSOCK32 ref: 00AB12C5
closesocket.WSOCK32(00000000), ref: 00AB12F4
listen.WSOCK32(00000000,00000005), ref: 00AB1303
WSAGetLastError.WSOCK32 ref: 00AB130D
closesocket.WSOCK32(00000000), ref: 00AB133C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 319629f2a64befe7abb006340e2ef73a12c9b75683afeefcfced23194de908eb
Instruction ID: 8a0eecdd56165925c3dcee699a5a6dd2fd751bc1187593d53687967552f86631
Opcode Fuzzy Hash: 319629f2a64befe7abb006340e2ef73a12c9b75683afeefcfced23194de908eb
Instruction Fuzzy Hash: BB4184716001009FD710DF64C594BAABBE9BF46328F598198E8569F293C771ED82CBE1

Function 00A9D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A33A97,?,?,00A32E7F,?,?,?,00000000), ref: 00A33AC2

Part of subcall function 00A9E199: GetFileAttributesW.KERNEL32(?,00A9CF95), ref: 00A9E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A9D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A9D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A9D481
FindClose.KERNEL32(00000000), ref: 00A9D498
FindClose.KERNEL32(00000000), ref: 00A9D4A1

Strings

\*.*, xrefs: 00A9D3F2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 155342cc440e259bdb8a9c60b8d40bd488ed66e008f6086ea7c8741e7b6d4bcf
Instruction ID: faa09e90ae9e6a0b52f90948321e9f171675eea9b6823f942abecbf061142ca5
Opcode Fuzzy Hash: 155342cc440e259bdb8a9c60b8d40bd488ed66e008f6086ea7c8741e7b6d4bcf
Instruction Fuzzy Hash: 87316C7100C345ABC704EFA4DA919AFB7E8BEE1314F444A1DF4D5931A1EB30AA49CB63

Function 00A6E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A6E645

Strings

1#IND, xrefs: 00A6F83D
1#SNAN, xrefs: 00A6F844
1#QNAN, xrefs: 00A6F84B
1#INF, xrefs: 00A6F852

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 554d004ff2d087de38442b006dd579c06765811b41e98ddfa260d1b71c6097a8
Instruction ID: 194b9f25ca0c04dd5dbc5855fd2668b7cdfd74ffdf5127293103f951e21980b6
Opcode Fuzzy Hash: 554d004ff2d087de38442b006dd579c06765811b41e98ddfa260d1b71c6097a8
Instruction Fuzzy Hash: 5FC24876E086288FDB25CF28DD407EAB7B5EB48305F1541EAD84EE7240E775AE858F40

Function 00AA648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AA64DC
CoInitialize.OLE32(00000000), ref: 00AA6639
CoCreateInstance.OLE32(00ACFCF8,00000000,00000001,00ACFB68,?), ref: 00AA6650
CoUninitialize.OLE32 ref: 00AA68D4

Strings

.lnk, xrefs: 00AA64BA, 00AA6524, 00AA65E0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 5f3f83910e4bef316b101afab37c7b6bdca93fbfb88726d22691793d48a18485
Instruction ID: 202fdedd414755520795814b866210de8155d5ddcd1c4bbcbcc032f513a6db4c
Opcode Fuzzy Hash: 5f3f83910e4bef316b101afab37c7b6bdca93fbfb88726d22691793d48a18485
Instruction Fuzzy Hash: 2BD13671508301AFC314EF24C981E6BB7E9FF99704F14496DF5958B2A1EB70E909CB92

Function 00AB22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00AB22E8

Part of subcall function 00AAE4EC: GetWindowRect.USER32(?,?), ref: 00AAE504

GetDesktopWindow.USER32 ref: 00AB2312
GetWindowRect.USER32(00000000), ref: 00AB2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00AB2355
GetCursorPos.USER32(?), ref: 00AB2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00AB23DF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: a027578c7a4c876d8735556ff98e1b46fe7bcc90df7696288b3ee6fc84eff75f
Instruction ID: 8e3b3f8dd12f77e89cc0a237ac5e144813e07c413e49030f39c8e9ad95cdd87a
Opcode Fuzzy Hash: a027578c7a4c876d8735556ff98e1b46fe7bcc90df7696288b3ee6fc84eff75f
Instruction Fuzzy Hash: 7A31C1725043159BCB20DF54C849F9BB7EDFF84710F00091AF5899B192DB35E909CB92

Function 00AA9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00AA9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00AA9C8B

Part of subcall function 00AA3874: GetInputState.USER32 ref: 00AA38CB
Part of subcall function 00AA3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AA3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00AA9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00AA9C75

Strings

*.*, xrefs: 00AA9B5D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 48edeb6992b70b0005a372e4ea01b04fce6d99fcf3bb60486507d7f78aee81a6
Instruction ID: d217a2ba196685515d64412f71d3950bd4f0c40d858d25616a48ada79adba788
Opcode Fuzzy Hash: 48edeb6992b70b0005a372e4ea01b04fce6d99fcf3bb60486507d7f78aee81a6
Instruction Fuzzy Hash: A6415C7194460AAFCF14DFA4C989AEEBBB8EF06320F248155F805A7191EB309E45CF61

Function 00A4997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00A49A4E
GetSysColor.USER32(0000000F), ref: 00A49B23
SetBkColor.GDI32(?,00000000), ref: 00A49B36

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 6cbafa47f5c2ad6c019249330b07a1eac15179523a084952fc970c62a3ffe1b7
Instruction ID: 9b72655d1ad0d5e7a3205a2a7d08ab8d979add253cd9e121048774ce32ea07ab
Opcode Fuzzy Hash: 6cbafa47f5c2ad6c019249330b07a1eac15179523a084952fc970c62a3ffe1b7
Instruction Fuzzy Hash: 36A10B74108554BEE729FB3C8D48E7F2AADEBC2390B254229F502D6691CA25DD23D371

Function 00AB1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB304E: inet_addr.WSOCK32(?), ref: 00AB307A
Part of subcall function 00AB304E: _wcslen.LIBCMT ref: 00AB309B

socket.WSOCK32(00000002,00000002,00000011), ref: 00AB185D
WSAGetLastError.WSOCK32 ref: 00AB1884
bind.WSOCK32(00000000,?,00000010), ref: 00AB18DB
WSAGetLastError.WSOCK32 ref: 00AB18E6
closesocket.WSOCK32(00000000), ref: 00AB1915

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 936f805f6f36d6343522b70ba66ea6f82f45e514b7f188e9a457735b0d400e56
Instruction ID: 5d6dea45bae79f067282ad42cba163de759402a6f5aed7e5a1a384a2c2c4cb07
Opcode Fuzzy Hash: 936f805f6f36d6343522b70ba66ea6f82f45e514b7f188e9a457735b0d400e56
Instruction Fuzzy Hash: 1651D675A00200AFDB10EF64C996F6A77E5AB44718F44845CFA0AAF3D3D771AD41CBA1

Function 00AC1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00AC1CC0
IsWindowEnabled.USER32 ref: 00AC1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00AC1CDB
IsIconic.USER32 ref: 00AC1CE9
IsZoomed.USER32 ref: 00AC1CF7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 75b469e70e6a42b4172446d678a0b6ea00b04988fba7bf42148fdee8e5c2754a
Instruction ID: 3bbfb717a0c8e6ec8582d5efaa63b705c617cfae937c42cb3dd2a3afb77a96ca
Opcode Fuzzy Hash: 75b469e70e6a42b4172446d678a0b6ea00b04988fba7bf42148fdee8e5c2754a
Instruction Fuzzy Hash: B621A3317442105FD7208F1AC884F6A7BE5EF96325F1A805CF84A8B352DB71DC42CB90

Function 00A38060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00A383E8
VUUU, xrefs: 00A75DF0
VUUU, xrefs: 00A383FA
VUUU, xrefs: 00A3843C
ERCP, xrefs: 00A3813C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: cdee8f5df5715b25e21315f171140131a56d44b07adfbe5fac22c9aa81a40aae
Instruction ID: 08c6a7f0195c2e3f2338ded926001802a0889a38cb091288beccd8fcdafcc2e7
Opcode Fuzzy Hash: cdee8f5df5715b25e21315f171140131a56d44b07adfbe5fac22c9aa81a40aae
Instruction Fuzzy Hash: B8A24F71E0061ACBDF24CF58C9417AEB7B1BF54314F24C5AAF819AB285EB749D81CB90

Function 00ABA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00ABA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00ABA6BA

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Process32NextW.KERNEL32(00000000,?), ref: 00ABA79C
CloseHandle.KERNEL32(00000000), ref: 00ABA7AB

Part of subcall function 00A4CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00A73303,?), ref: 00A4CE8A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 0f38ccbd9e1d2558db5fda898721eace64c987d13bcdd3b46ea748a63ee7aed5
Instruction ID: 86a256b0c6708af4b1a77678dda7e2a17f3dc02c3d933410dc87dcdc05bc4b82
Opcode Fuzzy Hash: 0f38ccbd9e1d2558db5fda898721eace64c987d13bcdd3b46ea748a63ee7aed5
Instruction Fuzzy Hash: 39517D75508300AFD710EF64C986E6BBBE8FF89754F00891DF58A97252EB70D904CB92

Function 00A9AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00A9AAAC
SetKeyboardState.USER32(00000080), ref: 00A9AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00A9AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00A9AB88

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7e14160868300a04171128ec53b06a11061b63c657e9fcf3624a15c0bd250f6b
Instruction ID: c4b4caa7b97f08750c2f8630e69faabec0ba4302c65d76ac35a6b082be376e39
Opcode Fuzzy Hash: 7e14160868300a04171128ec53b06a11061b63c657e9fcf3624a15c0bd250f6b
Instruction Fuzzy Hash: 11310330B40218AFEF35CB698C05BFA7BE6EB64320F04421BE585961D0D7749D81C7E2

Function 00A6BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A6BB7F

Part of subcall function 00A629C8: HeapFree.KERNEL32(00000000,00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000), ref: 00A629DE
Part of subcall function 00A629C8: GetLastError.KERNEL32(00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000,00000000), ref: 00A629F0

GetTimeZoneInformation.KERNEL32 ref: 00A6BB91
WideCharToMultiByte.KERNEL32(00000000,?,00B0121C,000000FF,?,0000003F,?,?), ref: 00A6BC09
WideCharToMultiByte.KERNEL32(00000000,?,00B01270,000000FF,?,0000003F,?,?,?,00B0121C,000000FF,?,0000003F,?,?), ref: 00A6BC36

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 9b3e7a9d163a9f4fc500ec22f28334ccb67aa15f5e4489cf06c300c0c90514c9
Instruction ID: 365a9084d4ca9dce744552766126f805c3e9e9ed5c2b4ddd3fb39dbc409f4db2
Opcode Fuzzy Hash: 9b3e7a9d163a9f4fc500ec22f28334ccb67aa15f5e4489cf06c300c0c90514c9
Instruction Fuzzy Hash: 3E31E171914205DFCB15DF69CC8096DBBB8FF5575071446AAE050EB2B1DB309E81CB60

Function 00AACE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00AACE89
GetLastError.KERNEL32(?,00000000), ref: 00AACEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00AACEFE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 927c6fa88b1a2875acd5d2c4fb75fe9dbeef3e9a6715f2ec6e2945be09434190
Instruction ID: adfddcb03e2067ba466b16e561e27ba52917168bb1eaa862dd05552830fadc7e
Opcode Fuzzy Hash: 927c6fa88b1a2875acd5d2c4fb75fe9dbeef3e9a6715f2ec6e2945be09434190
Instruction Fuzzy Hash: CE219D71500305AFEB30DFA5C948BAAB7F8EB41364F10442EE64693191E770EE09CB90

Function 00A98298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00A982AA

Strings

(, xrefs: 00A982F0
|, xrefs: 00A982DA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: c33438af2b67abcf8c49cec06d5b1df21f8582e6fa1b7d2e4bc30f3391497a3b
Instruction ID: dcefdf9e225108fd468a48c6017483058a5a863b3eb4cdf72a3767465ca432ff
Opcode Fuzzy Hash: c33438af2b67abcf8c49cec06d5b1df21f8582e6fa1b7d2e4bc30f3391497a3b
Instruction Fuzzy Hash: 88323575A006059FCB28CF59C481AAAB7F0FF48710B15C56EE59ADB3A1EB74E941CB40

Function 00AA5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AA5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00AA5D17
FindClose.KERNEL32(?), ref: 00AA5D5F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 71b8e8cb98d419ab729816a57c0c6e1536c67a5ed087f420b38bdaec823652f4
Instruction ID: 71a81fd7d32765d1aa1c4a084ebc5ed8e5518a3efadbd4093fc441f1636453a8
Opcode Fuzzy Hash: 71b8e8cb98d419ab729816a57c0c6e1536c67a5ed087f420b38bdaec823652f4
Instruction Fuzzy Hash: F0517875A04A019FC714DF28C494E9AB7E4FF4A324F14855EE99A8B3A1DB30ED05CF91

Function 00A62622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00A6271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A62724
UnhandledExceptionFilter.KERNEL32(?), ref: 00A62731

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e81ab4cea4b7f65b521fed6b66dcaad5ba34c1d5bea30740b0af7423a32b2b60
Instruction ID: 2e43d4434f2d8c5202955bb6afc4965c4a805e8e047ec75fd5dc224694f3065b
Opcode Fuzzy Hash: e81ab4cea4b7f65b521fed6b66dcaad5ba34c1d5bea30740b0af7423a32b2b60
Instruction Fuzzy Hash: 9231B47491121CABCB21DF64DD89BD9B7B8BF08310F5041EAE81CA7261E7309F858F45

Function 00AA51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AA51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00AA5238
SetErrorMode.KERNEL32(00000000), ref: 00AA52A1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 30382d53ce766d8650566fec836d87487fcf7b5432436404042cfce1287b466b
Instruction ID: 057f7d47fe290de0148184765e1f56013695ca1e975573fcbff6ba812da4d7e0
Opcode Fuzzy Hash: 30382d53ce766d8650566fec836d87487fcf7b5432436404042cfce1287b466b
Instruction Fuzzy Hash: 1F312F75A00518DFDB00DF95D884FADBBB4FF49314F098099E805AB392DB31E856CB91

Function 00A916C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00A4FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A50668
Part of subcall function 00A4FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A50685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A9170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A9173A
GetLastError.KERNEL32 ref: 00A9174A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 726c78f718c04ff620913bd18c2789cb37c20f0bc3f9d62c518497c9bcbbb4a0
Instruction ID: 1d8086bd7c08e8f6429902a94d185759628422eb9143a79c0a3368aba2e475b2
Opcode Fuzzy Hash: 726c78f718c04ff620913bd18c2789cb37c20f0bc3f9d62c518497c9bcbbb4a0
Instruction Fuzzy Hash: 7F1191B2904305AFE718DF94EC86D6AB7F9EF44724B24852EE05657641EB70BC428A60

Function 00A9D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A9D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00A9D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A9D650

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 725ee4b91ecd1e5ed94791eb8b750e2fd2e9441c45ee15a020708ba29d52e92e
Instruction ID: 98e8bde1f4d6ad7f3e45dcc2cec3d520dd5481f0ebf60780f55a178158081a00
Opcode Fuzzy Hash: 725ee4b91ecd1e5ed94791eb8b750e2fd2e9441c45ee15a020708ba29d52e92e
Instruction Fuzzy Hash: 30115E75E05228BFDB10CF95EC45FAFBBBCEB45B60F108115F908E7290D6704A058BA1

Function 00A91663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A9168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A916A1
FreeSid.ADVAPI32(?), ref: 00A916B1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1434128abb2ea4f3271bdcfb2f51819dc2673cd3974a8fa53c36aa77cacc41dd
Instruction ID: c0675aad3812389ab4d9825839a6b47a34878da28058ccbebf49a015be4a5cca
Opcode Fuzzy Hash: 1434128abb2ea4f3271bdcfb2f51819dc2673cd3974a8fa53c36aa77cacc41dd
Instruction Fuzzy Hash: 86F0F475950309FBDF00DFE49C89EAEBBBCFB08614F504565E901E2181E774AA458A54

Function 00A54CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00A628E9,?,00A54CBE,00A628E9,00AF88B8,0000000C,00A54E15,00A628E9,00000002,00000000,?,00A628E9), ref: 00A54D09
TerminateProcess.KERNEL32(00000000,?,00A54CBE,00A628E9,00AF88B8,0000000C,00A54E15,00A628E9,00000002,00000000,?,00A628E9), ref: 00A54D10
ExitProcess.KERNEL32 ref: 00A54D22

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a70386c5fcb5fe97d18c4e40e0dc8f19e49dc7d5afb4136156c20c3940e8b1c2
Instruction ID: d9f02add53db5d88b358cb6ca3437ee8ce878744e5cc689603cf51732a8fbfde
Opcode Fuzzy Hash: a70386c5fcb5fe97d18c4e40e0dc8f19e49dc7d5afb4136156c20c3940e8b1c2
Instruction Fuzzy Hash: C3E0B632400148AFCF11AF94EE09E597B79FB45796B154018FC198B222CB3ADD87CA90

Function 00A8D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A8D28C

Strings

X64, xrefs: 00A8D2A8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: dac364476b31265fa1d78cdedda41a604673af5b905795a232a00391704c4c8d
Instruction ID: 0b3e4944792afa8e83b9f21020972181c4fc9359fe69f2e69641784d7bd0987d
Opcode Fuzzy Hash: dac364476b31265fa1d78cdedda41a604673af5b905795a232a00391704c4c8d
Instruction Fuzzy Hash: 2ED0CAB880112DEACB90DBA0EC88DDAB3BCBB04316F100292F10AA2040EB3096498F20

Function 00A5CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: d8514f4940e39aae2bd67fa551105417ec72a065db3f67d63d9303cd380cecaa
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 09021B72E002199FDF14CFA9C9806ADBBF1FF48325F25816AD819E7385D731AA45CB80

Function 00AA68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AA6918
FindClose.KERNEL32(00000000), ref: 00AA6961

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 907b1c7e24a720f57d25189ed6b6bf6776b1e5d555c588b0a9b4569e77c8159f
Instruction ID: 6f2f901a7e07b1ced3160dd9a6416c0c044be420c2d3779b4436058b905bad5a
Opcode Fuzzy Hash: 907b1c7e24a720f57d25189ed6b6bf6776b1e5d555c588b0a9b4569e77c8159f
Instruction Fuzzy Hash: FB1190756042009FC710DF69D888A16BBE5FF89328F19C699F4698F6A2CB30EC05CF91

Function 00AA37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00AB4891,?,?,00000035,?), ref: 00AA37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00AB4891,?,?,00000035,?), ref: 00AA37F4

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 550f4ec1b39eba1cea3ea2d393b28fc8523ea2b78f97bf931c0d477cc1b710ab
Instruction ID: 94334d12b35970f3cb105309e4c6c59bd4ee11f3bc0db4d97e619b660df2123b
Opcode Fuzzy Hash: 550f4ec1b39eba1cea3ea2d393b28fc8523ea2b78f97bf931c0d477cc1b710ab
Instruction Fuzzy Hash: 37F0EC716043142ADB1097A65D4DFDB76ADDFC5771F000175F509D32C1D6605905C6B0

Function 00A910BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A911FC), ref: 00A910D4
CloseHandle.KERNEL32(?,?,00A911FC), ref: 00A910E9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d29a733472a5444739adb29a3a5e1f11e33a2da49989d201c773bd7d34f9f228
Instruction ID: bd6feee270eab70e8e19e83213900f527bd779849294981424047657d2fbe76f
Opcode Fuzzy Hash: d29a733472a5444739adb29a3a5e1f11e33a2da49989d201c773bd7d34f9f228
Instruction Fuzzy Hash: 57E04F36004600EEEB252B51FD05E7377E9EB04320B14882DF4A6804B1DB626C91DB10

Function 00A3CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00A80C40

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: d53a80d2e97627fef99c964a0dd598b611fadf55edcf92b29933890a8d0aaa11
Instruction ID: cc70070ae323b282e0d0f5cc3ca497e9685627bdf2caf621a691711e374759b1
Opcode Fuzzy Hash: d53a80d2e97627fef99c964a0dd598b611fadf55edcf92b29933890a8d0aaa11
Instruction Fuzzy Hash: F6327774900218DBCF14EF94C985EEEB7B5BF05354F248069F806BB292DB75AE49CB60

Function 00A6676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A66766,?,?,00000008,?,?,00A6FEFE,00000000), ref: 00A66998

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7c282ddc38825bcb0eeceb27b639fd3addcf022dabbf88874d25da39e9d4acc7
Instruction ID: a5d4a6b601ecd10e3b15dfdb96b740f659cf3f60169622ba314d2e035d4eb920
Opcode Fuzzy Hash: 7c282ddc38825bcb0eeceb27b639fd3addcf022dabbf88874d25da39e9d4acc7
Instruction Fuzzy Hash: 19B12A72610609DFD719CF28C48AB657BF0FF45364F298658E8A9CF2A2C735E991CB40

Function 00A4B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00A8851F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 75e6e1da6f53ed0a300143753495fffa2307dce7372b615e13bb23e6bc7cff9e
Instruction ID: e1109956878c14fb7ae8e27806c5b9ea27633abb2e906e984a5ace215d0c94fa
Opcode Fuzzy Hash: 75e6e1da6f53ed0a300143753495fffa2307dce7372b615e13bb23e6bc7cff9e
Instruction Fuzzy Hash: AD126F75910229DFCB24DF58C8806EEB7B5FF48710F54819AE849EB255EB349E81CFA0

Function 00AAEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00AAEABD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 0468e5d4b996c7980ab905b8cdb39ada0a5c67a027658d4c7db126d0de2dac6a
Instruction ID: 15504e78a9ee8b245ab423c4f12e9fb3b026ed211852b31d4f91052060337ffe
Opcode Fuzzy Hash: 0468e5d4b996c7980ab905b8cdb39ada0a5c67a027658d4c7db126d0de2dac6a
Instruction Fuzzy Hash: 6DE04F362102049FC710EF59D904E9AF7E9AF997B0F00841AFD4ADB391DB70EC418BA0

Function 00A509D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00A503EE), ref: 00A509DA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8430117ea047e51f111c3088f7f5317ccdffc52ecf8471f898601b6c55fa0dce
Instruction ID: 718fd98d59832d37f1438500e7b86c8a392d48f8ac15475ccdd35612a7534c88
Opcode Fuzzy Hash: 8430117ea047e51f111c3088f7f5317ccdffc52ecf8471f898601b6c55fa0dce
Instruction Fuzzy Hash:

Function 00A5781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00A5798B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: a6cc86ce13f633caa049d0576a126caf17e6dedc903956502eb63bb17d5289f4
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 39516A7160C7059BDB388768A95DBBE63D9BB12343F180509DC86F7282C635DE8DD362

Function 00A66DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da065ac3e331aeaee16112037136c360d0ff76393546089a28ab25eb3ac87de
Instruction ID: 8669f5a0e03e810e09624e1db3ca438fb0f2abed45914c93d41d8bf23af78f2f
Opcode Fuzzy Hash: 8da065ac3e331aeaee16112037136c360d0ff76393546089a28ab25eb3ac87de
Instruction Fuzzy Hash: 47320321D3AF414DD7239635C822339A759AFB73C9F15D737E82AB59A5EF29C4834200

Function 00A4CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73389ed75648908981a76ac9b72608d72e39b38e157d907418f54a4aed4da35
Instruction ID: a5545b4774aaba176c9dff9f7f9347602dc983632a8e89917f996c5fd23c4353
Opcode Fuzzy Hash: f73389ed75648908981a76ac9b72608d72e39b38e157d907418f54a4aed4da35
Instruction Fuzzy Hash: 23323636A00105CBDF28EF69C4D467DBBB1EB85330F28856AD59ACB291E230DD81DF60

Function 00A37920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab4d2fe19b7a2bf5641bcdbda64946fc6135cc224cf8e4eed8a001e5f7a90da
Instruction ID: d7072155f917e82e27f467fd90de0c7fdf13930d1dc6fd152a3d5417bba7b90f
Opcode Fuzzy Hash: eab4d2fe19b7a2bf5641bcdbda64946fc6135cc224cf8e4eed8a001e5f7a90da
Instruction Fuzzy Hash: F922B3B0E04609DFDF14CFA4C981AAEB7F5FF44300F248629E816AB291EB75AD55CB50

Function 00A391C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea07bf391afe096dc2bf1123e4a53bc72cf4833092357896cdaf757fd078f190
Instruction ID: d0746b3aecae70e085e106611ed0d42d7fe3866ac8956acf171ae84e7fb5e0a0
Opcode Fuzzy Hash: ea07bf391afe096dc2bf1123e4a53bc72cf4833092357896cdaf757fd078f190
Instruction Fuzzy Hash: C102B5B1E00205EFDF05DF54D981AAEB7B5FF48340F10C169F81A9B291EB71AA15CB91

Function 00A69EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67758d2e34a99e3cdab50247f5f878f503cebe964eeef91cbaba766f1ca4925
Instruction ID: 47fb70e11c4339c368184e3ebbc76a93e650bed81467b2a5517d41eac62b7f72
Opcode Fuzzy Hash: e67758d2e34a99e3cdab50247f5f878f503cebe964eeef91cbaba766f1ca4925
Instruction Fuzzy Hash: 46B1F021D2AF414DC62396798931336B75CAFBB6D5F92D31BFC2778D22EB2286834141

Function 00A51C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: f2da8e85e314d29de01a6038186ed8ea3cd67704c126b3345dd90d0830d8a828
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: EA9154731080A34ADB29473A857567EFEF16A523A371A079EDCF2CA1C1FE34895CD620

Function 00A51F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: bf356828bc785668ff6e784a77f9b34d8fd313fafd14a6131416bd6de7566d27
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: A99133722094A349DB694339857463EFEE17A933A371A079EDCF2CA1C5EE34895CD720

Function 00A519B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: c3f8e7f21e8c6eacc91fadd2a42b49be58f4349d27af359f522e81db96b5fa3f
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: C69143722090A34ADB2E437A857427DFFF16A923A371A079DD8F2CA1C1FE34855CD620

Function 00A57A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb733d3f5ea7a384693540f228847efd4ee20cdbf4002b19a51abe3f8ea325b
Instruction ID: b2e79097e10f8366f04cf92697c04f771c30d205d6b6881efcb978d6bedd476c
Opcode Fuzzy Hash: 4eb733d3f5ea7a384693540f228847efd4ee20cdbf4002b19a51abe3f8ea325b
Instruction Fuzzy Hash: CE617771608709A7EA349B28B995BBE23A4FF41743F140919ED43FB281DA359E4EC315

Function 00A57CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1dbc02a61d57ea636fbec343a14cca2d96463d64851f51c8e9207395e20e95
Instruction ID: 5047cd2628dc1f46873bfcb1f67b792fc52fbe1a7e623b77ca8c068629ff98cb
Opcode Fuzzy Hash: fe1dbc02a61d57ea636fbec343a14cca2d96463d64851f51c8e9207395e20e95
Instruction Fuzzy Hash: A0616C7220870956DE384B287956BBF23B4BF41703F100959ED43FB281EA369D4ECA55

Function 00A51706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 9cce9ebe233b0ec3472373fda7769561f10dfc8d433141a2e550fcdf02ec8258
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 718176726080A34ADB2D473D857467EFFE17A923A371A079DD8F2CA1C1EE34995CD620

Function 00A4D064 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811eb9dc288c2a78bdc6c52ec64344d3b3bd9064c1c515d2bac478a32243d890
Instruction ID: 3b4a600b593bf2056b0a53ab4ca8184405630c55767dd07e8ddb2ce9b4e7bb7c
Opcode Fuzzy Hash: 811eb9dc288c2a78bdc6c52ec64344d3b3bd9064c1c515d2bac478a32243d890
Instruction Fuzzy Hash: 73418FA244FBC55FEB0B87204C2A694BF70BEA366831846CFC8C05B5EFD7511186C78A

Function 00AA2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708ad3dc78c96923eb9e659817394851948578a0a3413da8c5223faf1c8270aa
Instruction ID: 9ff82aa1eccb88900ec4e34fee076346bf897a45106d065a45585a80e7eada3e
Opcode Fuzzy Hash: 708ad3dc78c96923eb9e659817394851948578a0a3413da8c5223faf1c8270aa
Instruction Fuzzy Hash: 6E21A5326206118BD728CF79C92267A73E5AB64310F15862EE4A7C37D1DE7AAD04CB80

Function 00AB2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00AB2B30
DeleteObject.GDI32(00000000), ref: 00AB2B43
DestroyWindow.USER32 ref: 00AB2B52
GetDesktopWindow.USER32 ref: 00AB2B6D
GetWindowRect.USER32(00000000), ref: 00AB2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00AB2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00AB2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2CF8
GetClientRect.USER32(00000000,?), ref: 00AB2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00AB2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2DA8
GlobalFree.KERNEL32(00000000), ref: 00AB2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00ACFC38,00000000), ref: 00AB2DDB
GlobalFree.KERNEL32(00000000), ref: 00AB2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00AB2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00AB2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AB303F

Strings

DISPLAY, xrefs: 00AB2EA2
static, xrefs: 00AB2D3A, 00AB2E91
AutoIt v3, xrefs: 00AB2CF2
, xrefs: 00AB2FC5

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: c1b1fc753f19df7b3479080e63d1d25904e8daf996eb1f1b389a6d401b98add1
Instruction ID: f315398225e6e6985cbb1881f74fcbf7d323084b8f4090a44ceeb1150ae04054
Opcode Fuzzy Hash: c1b1fc753f19df7b3479080e63d1d25904e8daf996eb1f1b389a6d401b98add1
Instruction Fuzzy Hash: 10026D71900205EFDB14DFA4CD89EAE7BB9FF49320F048559F919AB2A1DB74AD01CB60

Function 00AC70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00AC712F
GetSysColorBrush.USER32(0000000F), ref: 00AC7160
GetSysColor.USER32(0000000F), ref: 00AC716C
SetBkColor.GDI32(?,000000FF), ref: 00AC7186
SelectObject.GDI32(?,?), ref: 00AC7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00AC71C0
GetSysColor.USER32(00000010), ref: 00AC71C8
CreateSolidBrush.GDI32(00000000), ref: 00AC71CF
FrameRect.USER32(?,?,00000000), ref: 00AC71DE
DeleteObject.GDI32(00000000), ref: 00AC71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00AC7230
FillRect.USER32(?,?,?), ref: 00AC7262
GetWindowLongW.USER32(?,000000F0), ref: 00AC7284

Part of subcall function 00AC73E8: GetSysColor.USER32(00000012), ref: 00AC7421
Part of subcall function 00AC73E8: SetTextColor.GDI32(?,?), ref: 00AC7425
Part of subcall function 00AC73E8: GetSysColorBrush.USER32(0000000F), ref: 00AC743B
Part of subcall function 00AC73E8: GetSysColor.USER32(0000000F), ref: 00AC7446
Part of subcall function 00AC73E8: GetSysColor.USER32(00000011), ref: 00AC7463
Part of subcall function 00AC73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00AC7471
Part of subcall function 00AC73E8: SelectObject.GDI32(?,00000000), ref: 00AC7482
Part of subcall function 00AC73E8: SetBkColor.GDI32(?,00000000), ref: 00AC748B
Part of subcall function 00AC73E8: SelectObject.GDI32(?,?), ref: 00AC7498
Part of subcall function 00AC73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00AC74B7
Part of subcall function 00AC73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00AC74CE
Part of subcall function 00AC73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00AC74DB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: b19243aa73a92a70d9682586b9b382e2b97ac10954f0f5d7006aaa3d2d0840fa
Instruction ID: 4bc5c6aaaf9fb4157d2e080a06772ee0c1a414c8b595df1a4f6ee933f65687a8
Opcode Fuzzy Hash: b19243aa73a92a70d9682586b9b382e2b97ac10954f0f5d7006aaa3d2d0840fa
Instruction Fuzzy Hash: 65A18B72008305AFDB00DFA4DC48E6EBBA9FB88330F150B19F966961A1D730E9468F51

Function 00A48D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00A48E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00A86AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00A86AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00A86F43

Part of subcall function 00A48F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A48BE8,?,00000000,?,?,?,?,00A48BBA,00000000,?), ref: 00A48FC5

SendMessageW.USER32(?,00001053), ref: 00A86F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00A86F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A86FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A86FB7

Strings

0, xrefs: 00A86DCF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: b5058f8942a855a179460f29a1c0642b7706f08fea550b1c95377caff2d7b9a8
Instruction ID: 90c9f50b8211db677557eec8ebff6c03e83ef4e19710ae47008a2b2f7edd6e05
Opcode Fuzzy Hash: b5058f8942a855a179460f29a1c0642b7706f08fea550b1c95377caff2d7b9a8
Instruction Fuzzy Hash: B712BE34600201DFEB25EF18D949BAABBF1FB84310F148469F5898B261CB35EC52DF91

Function 00AB2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00AB273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00AB286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00AB28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00AB28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00AB2900
GetClientRect.USER32(00000000,?), ref: 00AB290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00AB2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00AB2964
GetStockObject.GDI32(00000011), ref: 00AB2974
SelectObject.GDI32(00000000,00000000), ref: 00AB2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00AB2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AB2991
DeleteDC.GDI32(00000000), ref: 00AB299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00AB29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00AB29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00AB2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00AB2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00AB2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00AB2A77
GetStockObject.GDI32(00000011), ref: 00AB2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00AB2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00AB2A97

Strings

DISPLAY, xrefs: 00AB295A
msctls_progress32, xrefs: 00AB2A13
static, xrefs: 00AB294F, 00AB2A71
AutoIt v3, xrefs: 00AB28F8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 7272917da0cbd220a1c27562da50b36f965a86a74c7c21c9e4a8b69e78e469eb
Instruction ID: db588b2f883254a45a7f6c44b4754e41e47a8c2d51ba317ca96a053f663f8942
Opcode Fuzzy Hash: 7272917da0cbd220a1c27562da50b36f965a86a74c7c21c9e4a8b69e78e469eb
Instruction Fuzzy Hash: 7FB16CB1A00219BFEB14DFA9CD49FAE7BB9EB08710F008515F915E7291DB70AD41CBA4

Function 00AA4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AA4AED
GetDriveTypeW.KERNEL32(?,00ACCB68,?,\\.\,00ACCC08), ref: 00AA4BCA
SetErrorMode.KERNEL32(00000000,00ACCB68,?,\\.\,00ACCC08), ref: 00AA4D36

Strings

RAMDisk, xrefs: 00AA4BF4
MMC, xrefs: 00AA4CDE
Fibre, xrefs: 00AA4CAD
CDROM, xrefs: 00AA4BFB
1394, xrefs: 00AA4C9F
PhysicalDrive, xrefs: 00AA4B76
Network, xrefs: 00AA4C02
FileBackedVirtual, xrefs: 00AA4CEC
RAID, xrefs: 00AA4CBB
SSA, xrefs: 00AA4CA6
ATAPI, xrefs: 00AA4C91
Virtual, xrefs: 00AA4CE5
ATA, xrefs: 00AA4C98
Unknown, xrefs: 00AA4BED, 00AA4C83
SSD, xrefs: 00AA4C4A
Removable, xrefs: 00AA4C10, 00AA4C15
Fixed, xrefs: 00AA4C09
SCSI, xrefs: 00AA4C8A
iSCSI, xrefs: 00AA4CC2
SATA, xrefs: 00AA4CD0
\\.\, xrefs: 00AA4B3F
SAS, xrefs: 00AA4CC9
USB, xrefs: 00AA4CB4

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: a6f09446c66d08c6a6deec940a6b2a8b6368dd5c42b2065c57e902942c1785be
Instruction ID: fcb0bdc4b09a50206111565adfcd41ac473a3add6ace3efbb2c04d630f706307
Opcode Fuzzy Hash: a6f09446c66d08c6a6deec940a6b2a8b6368dd5c42b2065c57e902942c1785be
Instruction Fuzzy Hash: 3261C030705309ABCB04DFA8CA82D7D77B0BB8E354B248815F90AAB6D1DBB5ED41DB51

Function 00AC73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00AC7421
SetTextColor.GDI32(?,?), ref: 00AC7425
GetSysColorBrush.USER32(0000000F), ref: 00AC743B
GetSysColor.USER32(0000000F), ref: 00AC7446
CreateSolidBrush.GDI32(?), ref: 00AC744B
GetSysColor.USER32(00000011), ref: 00AC7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00AC7471
SelectObject.GDI32(?,00000000), ref: 00AC7482
SetBkColor.GDI32(?,00000000), ref: 00AC748B
SelectObject.GDI32(?,?), ref: 00AC7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00AC74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00AC74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00AC74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00AC752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00AC7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00AC7572
DrawFocusRect.USER32(?,?), ref: 00AC757D
GetSysColor.USER32(00000011), ref: 00AC758E
SetTextColor.GDI32(?,00000000), ref: 00AC7596
DrawTextW.USER32(?,00AC70F5,000000FF,?,00000000), ref: 00AC75A8
SelectObject.GDI32(?,?), ref: 00AC75BF
DeleteObject.GDI32(?), ref: 00AC75CA
SelectObject.GDI32(?,?), ref: 00AC75D0
DeleteObject.GDI32(?), ref: 00AC75D5
SetTextColor.GDI32(?,?), ref: 00AC75DB
SetBkColor.GDI32(?,?), ref: 00AC75E5

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 59bc41233959ef49ee400fbe4e85f63029877ad74215aa8f81ee1156d2db043a
Instruction ID: 6f9166d7ceea9fcdffa61a098f449e271e9d99fba7b76a919fe1bf94495aaa2c
Opcode Fuzzy Hash: 59bc41233959ef49ee400fbe4e85f63029877ad74215aa8f81ee1156d2db043a
Instruction Fuzzy Hash: 7F614976900218AFDF01DFA4DC49EAEBFB9EB08320F164215F919AB2A1D7759941CF90

Function 00AC0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AC1128
GetDesktopWindow.USER32 ref: 00AC113D
GetWindowRect.USER32(00000000), ref: 00AC1144
GetWindowLongW.USER32(?,000000F0), ref: 00AC1199
DestroyWindow.USER32(?), ref: 00AC11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00AC11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00AC120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00AC121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00AC1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00AC1245
IsWindowVisible.USER32(00000000), ref: 00AC12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00AC12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00AC12D0
GetWindowRect.USER32(00000000,?), ref: 00AC12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00AC130E
GetMonitorInfoW.USER32(00000000,?), ref: 00AC1328
CopyRect.USER32(?,?), ref: 00AC133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00AC13AA

Strings

(, xrefs: 00AC131B
0, xrefs: 00AC10D3
tooltips_class32, xrefs: 00AC11E6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 873af843a820bb7e494213aeec92de30e9cd03683085f899771c631525a27553
Instruction ID: c3eebaab684ed7a031d7971b957cb65d0b8bd32fc4ea09ed4e95836ef4d5fb2c
Opcode Fuzzy Hash: 873af843a820bb7e494213aeec92de30e9cd03683085f899771c631525a27553
Instruction Fuzzy Hash: DBB1AC71604340AFDB00DF64C985F6ABBE4FF85314F01891CF9999B2A2C771E845CBA2

Function 00A48891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A48968
GetSystemMetrics.USER32(00000007), ref: 00A48970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A4899B
GetSystemMetrics.USER32(00000008), ref: 00A489A3
GetSystemMetrics.USER32(00000004), ref: 00A489C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00A489E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00A489F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00A48A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00A48A3C
GetClientRect.USER32(00000000,000000FF), ref: 00A48A5A
GetStockObject.GDI32(00000011), ref: 00A48A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00A48A81

Part of subcall function 00A4912D: GetCursorPos.USER32(?), ref: 00A49141
Part of subcall function 00A4912D: ScreenToClient.USER32(00000000,?), ref: 00A4915E
Part of subcall function 00A4912D: GetAsyncKeyState.USER32(00000001), ref: 00A49183
Part of subcall function 00A4912D: GetAsyncKeyState.USER32(00000002), ref: 00A4919D

SetTimer.USER32(00000000,00000000,00000028,00A490FC), ref: 00A48AA8

Strings

AutoIt v3 GUI, xrefs: 00A48A20

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: cfccb155228ca1f2fd4b0fabca417cc4682390c54cd83bab32c4938ab5acef20
Instruction ID: 9483650c40214ac72e4b317597f112ea302d75c7b63276f93d228d69c9243a2c
Opcode Fuzzy Hash: cfccb155228ca1f2fd4b0fabca417cc4682390c54cd83bab32c4938ab5acef20
Instruction Fuzzy Hash: 8FB18C35A00209AFDB14DFA8DD45FAE3BB5FB48314F114229FA19A7290DB74E941CB50

Function 00A90D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A910F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A91114
Part of subcall function 00A910F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A91120
Part of subcall function 00A910F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A9112F
Part of subcall function 00A910F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A91136
Part of subcall function 00A910F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A9114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A90DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A90E29
GetLengthSid.ADVAPI32(?), ref: 00A90E40
GetAce.ADVAPI32(?,00000000,?), ref: 00A90E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A90E96
GetLengthSid.ADVAPI32(?), ref: 00A90EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A90EB5
HeapAlloc.KERNEL32(00000000), ref: 00A90EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A90EDD
CopySid.ADVAPI32(00000000), ref: 00A90EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A90F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A90F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A90F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A90F6E
HeapFree.KERNEL32(00000000), ref: 00A90F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A90F7E
HeapFree.KERNEL32(00000000), ref: 00A90F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A90F8E
HeapFree.KERNEL32(00000000), ref: 00A90F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00A90FA1
HeapFree.KERNEL32(00000000), ref: 00A90FA8

Part of subcall function 00A91193: GetProcessHeap.KERNEL32(00000008,00A90BB1,?,00000000,?,00A90BB1,?), ref: 00A911A1
Part of subcall function 00A91193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A90BB1,?), ref: 00A911A8
Part of subcall function 00A91193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A90BB1,?), ref: 00A911B7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: ad58868e6b7e51d663a328223256bab4e13fc5e6985783122666a00d43e87528
Instruction ID: ce3f6d4f7f56015f70320bc7c87adcfccfdc0987f0ba75852d935eeb628461a6
Opcode Fuzzy Hash: ad58868e6b7e51d663a328223256bab4e13fc5e6985783122666a00d43e87528
Instruction Fuzzy Hash: 02715872A0021AEFDF20DFA5DD48FAEBBB8FF04351F154215E919E6191D7319A06CB60

Function 00ABC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ABC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00ACCC08,00000000,?,00000000,?,?), ref: 00ABC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00ABC5A4
_wcslen.LIBCMT ref: 00ABC5F4
_wcslen.LIBCMT ref: 00ABC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00ABC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00ABC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00ABC84D
RegCloseKey.ADVAPI32(?), ref: 00ABC881
RegCloseKey.ADVAPI32(00000000), ref: 00ABC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00ABC960

Strings

REG_EXPAND_SZ, xrefs: 00ABC5CD
REG_MULTI_SZ, xrefs: 00ABC6F5
REG_BINARY, xrefs: 00ABC913
REG_SZ, xrefs: 00ABC644
REG_QWORD, xrefs: 00ABC8C3
REG_DWORD, xrefs: 00ABC804

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: da5455d8210485cc55ec953d03d32cc1b5779565ae835a245ec02dd51e2e38c2
Instruction ID: 74cf4ea52ca122f167e0b368d8de96472429667a662738b782146b82cd0a8337
Opcode Fuzzy Hash: da5455d8210485cc55ec953d03d32cc1b5779565ae835a245ec02dd51e2e38c2
Instruction Fuzzy Hash: 9E125A75604201AFDB24DF14C981E6AB7E5FF88724F04885DF99A9B3A2DB31ED41CB81

Function 00AC091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00AC09C6
_wcslen.LIBCMT ref: 00AC0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00AC0A54
_wcslen.LIBCMT ref: 00AC0A8A
_wcslen.LIBCMT ref: 00AC0B06
_wcslen.LIBCMT ref: 00AC0B81

Part of subcall function 00A4F9F2: _wcslen.LIBCMT ref: 00A4F9FD

Part of subcall function 00A92BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A92BFA

Strings

COLLAPSE, xrefs: 00AC0B01, 00AC0B1C
GETSELECTED, xrefs: 00AC0C4E
GETTOTALCOUNT, xrefs: 00AC09F2, 00AC0A17
ISCHECKED, xrefs: 00AC0CE1
UNCHECK, xrefs: 00AC0D3E
EXISTS, xrefs: 00AC0B7C, 00AC0B97
SELECT, xrefs: 00AC0D11
GETITEMCOUNT, xrefs: 00AC0C1E
GETTEXT, xrefs: 00AC0C97
EXPAND, xrefs: 00AC0BF8
CHECK, xrefs: 00AC0A85, 00AC0AA0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 3b6bdb60789a0f0e371d84df987138e888178e8478abb861841fbc71d9e400f1
Instruction ID: 0e49094503377bd14af40a31e8ca54be677ad878ea5071976e17af986c0fd64d
Opcode Fuzzy Hash: 3b6bdb60789a0f0e371d84df987138e888178e8478abb861841fbc71d9e400f1
Instruction Fuzzy Hash: B4E16735208301DFCB14DF68C550E2AB7E1BF98754F16895CF89AAB2A2DB31ED45CB81

Function 00ABC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ABB6AE,?,?), ref: 00ABC9B5
_wcslen.LIBCMT ref: 00ABC9F1
_wcslen.LIBCMT ref: 00ABCA68
_wcslen.LIBCMT ref: 00ABCA9E
_wcslen.LIBCMT ref: 00ABCAF9
_wcslen.LIBCMT ref: 00ABCB2F
_wcslen.LIBCMT ref: 00ABCB7F

Strings

HKEY_USERS, xrefs: 00ABCBDF
HKEY_CLASSES_ROOT, xrefs: 00ABCAF3, 00ABCAF8
HKCR, xrefs: 00ABCB29, 00ABCB2E
HKLM, xrefs: 00ABCA98, 00ABCA9D
HKU, xrefs: 00ABCBF0
HKEY_CURRENT_CONFIG, xrefs: 00ABCB79, 00ABCB7E
HKCU, xrefs: 00ABCBCE
HKCC, xrefs: 00ABCBAC
HKEY_LOCAL_MACHINE, xrefs: 00ABCA62, 00ABCA67
HKEY_CURRENT_USER, xrefs: 00ABCBBD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 3fd57216ac3c71678ccabcb43d981a1662de99894249b5a4933be440b37d56eb
Instruction ID: a7bf0025a890554c50d2f0bc4b79c6e6c518b4b064d0d954650fec8874e11c7e
Opcode Fuzzy Hash: 3fd57216ac3c71678ccabcb43d981a1662de99894249b5a4933be440b37d56eb
Instruction Fuzzy Hash: EC71D73261012A8BCB10DF7CCD51DFF37AAAB657B4F250528FC5597286E631CD4593A0

Function 00AC833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AC835A
_wcslen.LIBCMT ref: 00AC836E
_wcslen.LIBCMT ref: 00AC8391
_wcslen.LIBCMT ref: 00AC83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00AC83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00AC361A,?), ref: 00AC844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00AC8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00AC84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00AC8501
FreeLibrary.KERNEL32(?), ref: 00AC850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00AC851D
DestroyIcon.USER32(?), ref: 00AC852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00AC8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00AC8555

Strings

.dll, xrefs: 00AC83AB
.icl, xrefs: 00AC8368
.exe, xrefs: 00AC8388

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 791e988c663a7991f0bc67da7452798556305dfc674260e154d6b6bc50c7e59a
Instruction ID: 601cdb6aa560fb05c0da100decd0774dd9ee3c440d3574c5791d47bc9b1783d0
Opcode Fuzzy Hash: 791e988c663a7991f0bc67da7452798556305dfc674260e154d6b6bc50c7e59a
Instruction Fuzzy Hash: 9E61D271540219FAEB18DF64CD41FBE77A8BB08B21F11450AF915EA1D1DFB8A981CBA0

Function 00A37778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#ce, xrefs: 00A378ED
#OnAutoItStartRegister, xrefs: 00A37817
Bad directive syntax error, xrefs: 00A7519A
#requireadmin, xrefs: 00A377FF
', xrefs: 00A75169
#include, xrefs: 00A37847
#comments-start, xrefs: 00A3785F, 00A378B1
#pragma compile, xrefs: 00A377D3
Cannot parse #include, xrefs: 00A75279
", xrefs: 00A75153
#cs, xrefs: 00A37873, 00A378C5
#comments-end, xrefs: 00A378D9
#notrayicon, xrefs: 00A377E7
Unterminated group of comments, xrefs: 00A7528C
#include-once, xrefs: 00A3782F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: d96cc07a57c4399c222cdec738462dc3e88bdc8269b023e11df75520c1aeee27
Instruction ID: 17dbab304ad09a83811b240eaa6d259659164b313f866259f11daec7def34514
Opcode Fuzzy Hash: d96cc07a57c4399c222cdec738462dc3e88bdc8269b023e11df75520c1aeee27
Instruction Fuzzy Hash: B781C2B1A04605BFDB20AF60CD42FAE77B9BF55301F048424FD09AA292EBB4D955C791

Function 00AA3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00AA3EF8
_wcslen.LIBCMT ref: 00AA3F03
_wcslen.LIBCMT ref: 00AA3F5A
_wcslen.LIBCMT ref: 00AA3F98
GetDriveTypeW.KERNEL32(?), ref: 00AA3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AA401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AA4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AA4087

Strings

close cd wait, xrefs: 00AA4072
set cd door , xrefs: 00AA4028
open, xrefs: 00AA3F54, 00AA3F59
closed, xrefs: 00AA3F08, 00AA3F2D, 00AA3F46, 00AA3F7E, 00AA3F97
wait, xrefs: 00AA4044
type cdaudio alias cd wait, xrefs: 00AA4001
open , xrefs: 00AA3FE5
close, xrefs: 00AA3EFE, 00AA3F18

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: c1b47f186997f0394048a22dbfd88f491feca556d16bec65f4036c04814ae0c7
Instruction ID: 5ecf0b94c623ba78c5bddaa2ddf3d229f2f26ffe70ad46af3ffd9680c86e9f6d
Opcode Fuzzy Hash: c1b47f186997f0394048a22dbfd88f491feca556d16bec65f4036c04814ae0c7
Instruction Fuzzy Hash: 3071EF326042019FC710EF24C98196EB7F4FF99768F10892DF99697291EB31ED46CB91

Function 00A95A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A95A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A95A40
SetWindowTextW.USER32(?,?), ref: 00A95A57
GetDlgItem.USER32(?,000003EA), ref: 00A95A6C
SetWindowTextW.USER32(00000000,?), ref: 00A95A72
GetDlgItem.USER32(?,000003E9), ref: 00A95A82
SetWindowTextW.USER32(00000000,?), ref: 00A95A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A95AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A95AC3
GetWindowRect.USER32(?,?), ref: 00A95ACC
_wcslen.LIBCMT ref: 00A95B33
SetWindowTextW.USER32(?,?), ref: 00A95B6F
GetDesktopWindow.USER32 ref: 00A95B75
GetWindowRect.USER32(00000000), ref: 00A95B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00A95BD3
GetClientRect.USER32(?,?), ref: 00A95BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00A95C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A95C2F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 20a188b7b9a671f8370a3033e0fc2e6014c2e5696955003cab23096de89ce86a
Instruction ID: a1c7788368d5766414ca5739594b9ec3434d1c5317fd6f6165eae64b757991f3
Opcode Fuzzy Hash: 20a188b7b9a671f8370a3033e0fc2e6014c2e5696955003cab23096de89ce86a
Instruction Fuzzy Hash: 80716B31A00A09AFDF21DFB8CE86E6EBBF5FF48714F104518E586A25A0D775E941CB10

Function 00AAFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00AAFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00AAFE32
LoadCursorW.USER32(00000000,00007F00), ref: 00AAFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00AAFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00AAFE53
LoadCursorW.USER32(00000000,00007F01), ref: 00AAFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00AAFE69
LoadCursorW.USER32(00000000,00007F88), ref: 00AAFE74
LoadCursorW.USER32(00000000,00007F80), ref: 00AAFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00AAFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00AAFE95
LoadCursorW.USER32(00000000,00007F85), ref: 00AAFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00AAFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00AAFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00AAFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00AAFECC
GetCursorInfo.USER32(?), ref: 00AAFEDC
GetLastError.KERNEL32 ref: 00AAFF1E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 9dbfa202188252f64e6d6d4bc96d3e189301b06eab7f022760d78bac0b1b5c7c
Instruction ID: 794368fe03c4cc614e48c823a7c3e23cb2fc751ed68c8dbd3b8b1c0e8b4def5f
Opcode Fuzzy Hash: 9dbfa202188252f64e6d6d4bc96d3e189301b06eab7f022760d78bac0b1b5c7c
Instruction Fuzzy Hash: 004132B0D043196EDB10DFBA8C8585EBFA8FF05754B54452AF11DEB281DB7899018E91

Function 00A500C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00A500C6

Part of subcall function 00A500ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00B0070C,00000FA0,AC764822,?,?,?,?,00A723B3,000000FF), ref: 00A5011C
Part of subcall function 00A500ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00A723B3,000000FF), ref: 00A50127
Part of subcall function 00A500ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00A723B3,000000FF), ref: 00A50138
Part of subcall function 00A500ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00A5014E
Part of subcall function 00A500ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A5015C
Part of subcall function 00A500ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A5016A
Part of subcall function 00A500ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A50195
Part of subcall function 00A500ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A501A0

___scrt_fastfail.LIBCMT ref: 00A500E7

Part of subcall function 00A500A3: __onexit.LIBCMT ref: 00A500A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A50122
InitializeConditionVariable, xrefs: 00A50148
kernel32.dll, xrefs: 00A50133
SleepConditionVariableCS, xrefs: 00A50154
WakeAllConditionVariable, xrefs: 00A50162

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 583078eceac618ceab11c2e2e9b71ed877bed70f3464f096871ae92eea9754fd
Instruction ID: 5041f37ddfc358c52b951295d106d0477f10ffddc657f0e2478e1be476c22fdc
Opcode Fuzzy Hash: 583078eceac618ceab11c2e2e9b71ed877bed70f3464f096871ae92eea9754fd
Instruction Fuzzy Hash: DC210B326447107FE711ABA4AD06F6A37D4FB44F62F050639FC05A72D1DF749C058A91

Function 00A930F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A9318D
_wcslen.LIBCMT ref: 00A931F8

Strings

CLASSNN, xrefs: 00A931F3, 00A93204
TEXT, xrefs: 00A9347C
NAME, xrefs: 00A93335, 00A93346
INSTANCE, xrefs: 00A93453
CLASS, xrefs: 00A93188, 00A931A5
REGEXPCLASS, xrefs: 00A93255, 00A93266

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 5bcc88230409a3818fed56a1e08182b85057ee9af44d4aa6d56f714b93db51bd
Instruction ID: e50c39415e9a44c66f0ed5a8d71d00c927ba3c5d285c8fc8fb5fb72fd2d160f8
Opcode Fuzzy Hash: 5bcc88230409a3818fed56a1e08182b85057ee9af44d4aa6d56f714b93db51bd
Instruction Fuzzy Hash: 2BE19333B00526AFCF189FB8C8516FEBBF4BF58710F658119E556A7250DB30AE858790

Function 00AA44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00ACCC08), ref: 00AA4527
_wcslen.LIBCMT ref: 00AA453B
_wcslen.LIBCMT ref: 00AA4599
_wcslen.LIBCMT ref: 00AA45F4
_wcslen.LIBCMT ref: 00AA463F
_wcslen.LIBCMT ref: 00AA46A7

Part of subcall function 00A4F9F2: _wcslen.LIBCMT ref: 00A4F9FD

GetDriveTypeW.KERNEL32(?,00AF6BF0,00000061), ref: 00AA4743

Strings

fixed, xrefs: 00AA4635, 00AA463A
cdrom, xrefs: 00AA458F, 00AA4594
network, xrefs: 00AA469D, 00AA46A2
ramdisk, xrefs: 00AA46F1
unknown, xrefs: 00AA4708
removable, xrefs: 00AA45EA, 00AA45EF
all, xrefs: 00AA4531, 00AA4536

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 8aa18f13cf8524f2104134d9eb843cfdc3644b687d4b3bdb5db1334c37f7773a
Instruction ID: 089b1b7c9e55243e3b3022d714e7ea6663f279d8190ec9924ea1f4f5c868b6e2
Opcode Fuzzy Hash: 8aa18f13cf8524f2104134d9eb843cfdc3644b687d4b3bdb5db1334c37f7773a
Instruction Fuzzy Hash: 49B1DB71A083029FC710DF28C991A6AB7E5AFEA720F50491DF496C72D1E7B0D845CBA2

Function 00AB3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00ACCC08), ref: 00AB40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00AB40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00ACCC08), ref: 00AB40F2
FreeLibrary.KERNEL32(00000000,?,00ACCC08), ref: 00AB413E
StringFromGUID2.OLE32(?,?,00000028,?,00ACCC08), ref: 00AB41A8
SysFreeString.OLEAUT32(00000009), ref: 00AB4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00AB42C8
SysFreeString.OLEAUT32(?), ref: 00AB42F2

Strings

GetModuleHandleExW, xrefs: 00AB40C7
kernel32.dll, xrefs: 00AB40B6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: f7f3032b240118854941609bec46e852eaadb074a9b1be3dfeac3482769d2efd
Instruction ID: e93dcd9f93f396c71f20d7001256a5c28844e335272b0a9edd89478a915605f7
Opcode Fuzzy Hash: f7f3032b240118854941609bec46e852eaadb074a9b1be3dfeac3482769d2efd
Instruction Fuzzy Hash: CB123A75A00119EFDB14DF94C884EAEBBB9FF49314F248098F9099B252D731ED46CBA0

Function 00A3326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00B01990), ref: 00A72F8D
GetMenuItemCount.USER32(00B01990), ref: 00A7303D
GetCursorPos.USER32(?), ref: 00A73081
SetForegroundWindow.USER32(00000000), ref: 00A7308A
TrackPopupMenuEx.USER32(00B01990,00000000,?,00000000,00000000,00000000), ref: 00A7309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A730A9

Strings

0, xrefs: 00A3327D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 4312b37ec7f2d2226a1722f3da330e5d3929d2620b065a2cfb89a4ba035ed682
Instruction ID: 74c4b1ed8e1628f5ab87b301b91a88f6bb9855caa931b6c9d2c1846b5242802b
Opcode Fuzzy Hash: 4312b37ec7f2d2226a1722f3da330e5d3929d2620b065a2cfb89a4ba035ed682
Instruction Fuzzy Hash: AA71D471644205BFEF258F64DD49FAABF68FF05364F20C216F5286A1E1C7B1A920DB90

Function 00AC6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00AC6DEB

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00AC6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00AC6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00AC6E94
DestroyWindow.USER32(?), ref: 00AC6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00A30000,00000000), ref: 00AC6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00AC6EFD
GetDesktopWindow.USER32 ref: 00AC6F16
GetWindowRect.USER32(00000000), ref: 00AC6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00AC6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00AC6F4D

Part of subcall function 00A49944: GetWindowLongW.USER32(?,000000EB), ref: 00A49952

Strings

0, xrefs: 00AC6D98
tooltips_class32, xrefs: 00AC6E58, 00AC6EDD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 7e712aaa30653a43430c76d91eee7f33b7870dc05d007fff8027887b41c16cdf
Instruction ID: ae791519d1c051d857dcd368a2e2b9da175b0a5495eb63860ddd05675b4469dd
Opcode Fuzzy Hash: 7e712aaa30653a43430c76d91eee7f33b7870dc05d007fff8027887b41c16cdf
Instruction Fuzzy Hash: 97715374104244AFDB21CF28DD48FAABBE9FF89314F05081EF98997261DB74E906DB52

Function 00AC911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

DragQueryPoint.SHELL32(?,?), ref: 00AC9147

Part of subcall function 00AC7674: ClientToScreen.USER32(?,?), ref: 00AC769A
Part of subcall function 00AC7674: GetWindowRect.USER32(?,?), ref: 00AC7710
Part of subcall function 00AC7674: PtInRect.USER32(?,?,00AC8B89), ref: 00AC7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00AC91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00AC91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00AC91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00AC9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00AC923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00AC9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00AC9277
DragFinish.SHELL32(?), ref: 00AC927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00AC9371

Strings

@GUI_DRAGFILE, xrefs: 00AC9320
@GUI_DROPID, xrefs: 00AC929E
@GUI_DRAGID, xrefs: 00AC92E9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: be75d647484f5953243c67a27127f4f5fbc283af8523d590a4da6467fe789aa8
Instruction ID: ebe3d902a55a2a766de162c6d4fe867987bca43a5e153a9103fec4d462fe48c2
Opcode Fuzzy Hash: be75d647484f5953243c67a27127f4f5fbc283af8523d590a4da6467fe789aa8
Instruction Fuzzy Hash: B7616971108301AFC705DFA4DD89EAFBBE8EF98750F00491EF596962A0DB709A49CB52

Function 00AAC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00AAC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00AAC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00AAC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00AAC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00AAC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00AAC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AAC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00AAC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00AAC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00AAC5F0
InternetCloseHandle.WININET(00000000), ref: 00AAC5FB

Strings

, xrefs: 00AAC575

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: c7a76df246a90e29ba07c0788e50db0bbf8536f7edecec9da3ff4871706830af
Instruction ID: bd0e2118308d85ce80ee4afd465464612b6ec2b352aec4f98715afdd82e74a5e
Opcode Fuzzy Hash: c7a76df246a90e29ba07c0788e50db0bbf8536f7edecec9da3ff4871706830af
Instruction Fuzzy Hash: 1C514BB0940305BFEB21DFA4C948AAA7BFCFF09764F00441AF94A97690DB34E945DB60

Function 00AC856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00AC8592
GetFileSize.KERNEL32(00000000,00000000), ref: 00AC85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00AC85AD
CloseHandle.KERNEL32(00000000), ref: 00AC85BA
GlobalLock.KERNEL32(00000000), ref: 00AC85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00AC85D7
GlobalUnlock.KERNEL32(00000000), ref: 00AC85E0
CloseHandle.KERNEL32(00000000), ref: 00AC85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00AC85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00ACFC38,?), ref: 00AC8611
GlobalFree.KERNEL32(00000000), ref: 00AC8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00AC8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00AC8671
DeleteObject.GDI32(00000000), ref: 00AC8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00AC86AF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 39db77610f7564a9fb67a73c7e7133a4ccddb57d2690b2c29855d98c6100a502
Instruction ID: 884b6d6bbf4a0d8935fc91878c1a7875c881fdb8ad38ed68a8a4528b734d812e
Opcode Fuzzy Hash: 39db77610f7564a9fb67a73c7e7133a4ccddb57d2690b2c29855d98c6100a502
Instruction Fuzzy Hash: 39412B75600208AFDB11DFA5DC48EAABBBCFF89721F164058F919E7260DB749902CB20

Function 00AA14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00AA1502
VariantCopy.OLEAUT32(?,?), ref: 00AA150B
VariantClear.OLEAUT32(?), ref: 00AA1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00AA15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00AA1657
VariantInit.OLEAUT32(?), ref: 00AA1708
SysFreeString.OLEAUT32(?), ref: 00AA178C
VariantClear.OLEAUT32(?), ref: 00AA17D8
VariantClear.OLEAUT32(?), ref: 00AA17E7
VariantInit.OLEAUT32(00000000), ref: 00AA1823

Strings

Default, xrefs: 00AA16AF
%4d%02d%02d%02d%02d%02d, xrefs: 00AA1625

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 11eed04afc336e3326b31ba5571c36643fd627d7dc86c3f3ed46c25a8b100449
Instruction ID: 5dccc04450d062457926f17bf386138675b562a35689d362a44ad07c200ac9d9
Opcode Fuzzy Hash: 11eed04afc336e3326b31ba5571c36643fd627d7dc86c3f3ed46c25a8b100449
Instruction Fuzzy Hash: F1D1CC31A00616EBDB04AFA5D999B79B7B5BF46700F14845AF44AAB1C0DB30EC41DBA2

Function 00ABB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00ABC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ABB6AE,?,?), ref: 00ABC9B5
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABC9F1
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA68
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ABB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00ABB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00ABB80A
RegCloseKey.ADVAPI32(?), ref: 00ABB87E
RegCloseKey.ADVAPI32(?), ref: 00ABB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00ABB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00ABB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00ABB922
FreeLibrary.KERNEL32(00000000), ref: 00ABB983
RegCloseKey.ADVAPI32(00000000), ref: 00ABB994

Strings

advapi32.dll, xrefs: 00ABB8ED
RegDeleteKeyExW, xrefs: 00ABB8FE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 5aaadb2247ab2d4ac7511c06ab54d5991026fc68c1339dc3114b85b34ec25877
Instruction ID: 889bd60b8af700e606e35e5a70e0d4ecf2bf4810b7ddc657695ea835bb2424e9
Opcode Fuzzy Hash: 5aaadb2247ab2d4ac7511c06ab54d5991026fc68c1339dc3114b85b34ec25877
Instruction Fuzzy Hash: 66C18C34218201AFD714DF54C494F6ABBE9BF84318F14855CF49A9B2A3CBB1EC46CBA1

Function 00AB255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00AB25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00AB25E8
CreateCompatibleDC.GDI32(?), ref: 00AB25F4
SelectObject.GDI32(00000000,?), ref: 00AB2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00AB266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00AB26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00AB26D0
SelectObject.GDI32(?,?), ref: 00AB26D8
DeleteObject.GDI32(?), ref: 00AB26E1
DeleteDC.GDI32(?), ref: 00AB26E8
ReleaseDC.USER32(00000000,?), ref: 00AB26F3

Strings

(, xrefs: 00AB268D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 0888a780e509d452b4bf98ea52cd707fade4dd7495e942421f8b980c940b52c2
Instruction ID: aea815c7803c8916c1510ed08edde7681754ff1a32f08e3f2461602fe559e277
Opcode Fuzzy Hash: 0888a780e509d452b4bf98ea52cd707fade4dd7495e942421f8b980c940b52c2
Instruction Fuzzy Hash: 3961E175D00219EFCF14CFE8D984EAEBBB9FF48310F24852AE959A7251E770A9418F50

Function 00A6DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00A6DAA1

Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D659
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D66B
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D67D
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D68F
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D6A1
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D6B3
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D6C5
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D6D7
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D6E9
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D6FB
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D70D
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D71F
Part of subcall function 00A6D63C: _free.LIBCMT ref: 00A6D731

_free.LIBCMT ref: 00A6DA96

Part of subcall function 00A629C8: HeapFree.KERNEL32(00000000,00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000), ref: 00A629DE
Part of subcall function 00A629C8: GetLastError.KERNEL32(00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000,00000000), ref: 00A629F0

_free.LIBCMT ref: 00A6DAB8
_free.LIBCMT ref: 00A6DACD
_free.LIBCMT ref: 00A6DAD8
_free.LIBCMT ref: 00A6DAFA
_free.LIBCMT ref: 00A6DB0D
_free.LIBCMT ref: 00A6DB1B
_free.LIBCMT ref: 00A6DB26
_free.LIBCMT ref: 00A6DB5E
_free.LIBCMT ref: 00A6DB65
_free.LIBCMT ref: 00A6DB82
_free.LIBCMT ref: 00A6DB9A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9db3ba5dbf89d52e90be0857aa22687eeb7c165e4303580914063e480c38dad0
Instruction ID: 385263050b5693f0523638d71c493e5363f5c9237c7721f38530787da7df208c
Opcode Fuzzy Hash: 9db3ba5dbf89d52e90be0857aa22687eeb7c165e4303580914063e480c38dad0
Instruction Fuzzy Hash: A6314832B046059FEB25AB79E945B6AB7F9FF903A0F154429E449D7191DA31AC808B20

Function 00A9365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A9369C
_wcslen.LIBCMT ref: 00A936A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A93797
GetClassNameW.USER32(?,?,00000400), ref: 00A9380C
GetDlgCtrlID.USER32(?), ref: 00A9385D
GetWindowRect.USER32(?,?), ref: 00A93882
GetParent.USER32(?), ref: 00A938A0
ScreenToClient.USER32(00000000), ref: 00A938A7
GetClassNameW.USER32(?,?,00000100), ref: 00A93921
GetWindowTextW.USER32(?,?,00000400), ref: 00A9395D

Strings

%s%u, xrefs: 00A93734

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b0703a0df167b49feeacbf887ca95b94f82eceb5954f44267ab701b8e3c9df99
Instruction ID: 1a213f9edd759f781967a7773b96ed033fa9a5e30198e38e3367f051e5abd59a
Opcode Fuzzy Hash: b0703a0df167b49feeacbf887ca95b94f82eceb5954f44267ab701b8e3c9df99
Instruction Fuzzy Hash: 2691AE72304606AFDF19DF64C995FAAB7F8FF44350F008629F999C6190DB30AA46CB91

Function 00A94954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00A94994
GetWindowTextW.USER32(?,?,00000400), ref: 00A949DA
_wcslen.LIBCMT ref: 00A949EB
CharUpperBuffW.USER32(?,00000000), ref: 00A949F7
_wcsstr.LIBVCRUNTIME ref: 00A94A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00A94A64
GetWindowTextW.USER32(?,?,00000400), ref: 00A94A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00A94AE6
GetClassNameW.USER32(?,?,00000400), ref: 00A94B20
GetWindowRect.USER32(?,?), ref: 00A94B8B

Strings

ThumbnailClass, xrefs: 00A94A6F, 00A94AF1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: f364ca37972090b64569069987aba521fd9ae70dfd71ac8dcecf4d0dacecddeb
Instruction ID: 61e58b67718ea8a5878501e21f346efa1da9ebae671ad168a655712f3c93c2c5
Opcode Fuzzy Hash: f364ca37972090b64569069987aba521fd9ae70dfd71ac8dcecf4d0dacecddeb
Instruction Fuzzy Hash: E991AF712082059FDF04DF54CA85FAA77E8FF88354F048469FD899A196EB30ED46CBA1

Function 00A9BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00B01990,000000FF,00000000,00000030), ref: 00A9BFAC
SetMenuItemInfoW.USER32(00B01990,00000004,00000000,00000030), ref: 00A9BFE1
Sleep.KERNEL32(000001F4), ref: 00A9BFF3
GetMenuItemCount.USER32(?), ref: 00A9C039
GetMenuItemID.USER32(?,00000000), ref: 00A9C056
GetMenuItemID.USER32(?,-00000001), ref: 00A9C082
GetMenuItemID.USER32(?,?), ref: 00A9C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A9C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A9C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A9C145

Strings

0, xrefs: 00A9BF3D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: ee70e6bd35d5d0b2c5e940dafb4b86878c3f6472e82031cadbcdd11969494327
Instruction ID: 284dafd8be9c8bf5381c8fe91df33e5bb21f910672cebee9404fbf225fb0453f
Opcode Fuzzy Hash: ee70e6bd35d5d0b2c5e940dafb4b86878c3f6472e82031cadbcdd11969494327
Instruction Fuzzy Hash: 40619FB0A0064AAFDF15CFA8DE88EEE7BF8EB05364F104155F815A7292C735AD45CB60

Function 00ABCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00ABCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00ABCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00ABCD48

Part of subcall function 00ABCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00ABCCAA
Part of subcall function 00ABCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00ABCCBD
Part of subcall function 00ABCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00ABCCCF
Part of subcall function 00ABCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00ABCD05
Part of subcall function 00ABCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00ABCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00ABCCF3

Strings

advapi32.dll, xrefs: 00ABCCB8
RegDeleteKeyExW, xrefs: 00ABCCC9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 49cad26a5080f9c520bc89acead4e30f36fcd1e0b5a5e216389d5fa2dd3124d5
Instruction ID: d15d10a468772f238707f58827cbf2dda0a4a581cad2df665684a88b5cbf1392
Opcode Fuzzy Hash: 49cad26a5080f9c520bc89acead4e30f36fcd1e0b5a5e216389d5fa2dd3124d5
Instruction Fuzzy Hash: C3316075901129BBD720CB95DC88EFFBB7CEF56760F010165F909E3141D7349A469AA0

Function 00AA3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AA3D40
_wcslen.LIBCMT ref: 00AA3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00AA3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00AA3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00AA3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00AA3E55
CloseHandle.KERNEL32(00000000), ref: 00AA3E60
CloseHandle.KERNEL32(00000000), ref: 00AA3E6B

Strings

\, xrefs: 00AA3D77
:, xrefs: 00AA3D82
\??\%s, xrefs: 00AA3D5B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: b2ceb90e3df63902d055369a8e95aca9b030b2096263409dcf7e0ffaa4679865
Instruction ID: 8e6d033678110d05981940a63d78ca4cedc31e22e71faac1c2ce3028841f451e
Opcode Fuzzy Hash: b2ceb90e3df63902d055369a8e95aca9b030b2096263409dcf7e0ffaa4679865
Instruction Fuzzy Hash: 9831CF76900209ABDB21DBA0DC49FEF37BCEF89750F1040B6FA09D61A0EB7497458B24

Function 00A9E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A9E6B4

Part of subcall function 00A4E551: timeGetTime.WINMM(?,?,00A9E6D4), ref: 00A4E555

Sleep.KERNEL32(0000000A), ref: 00A9E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00A9E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A9E727
SetActiveWindow.USER32 ref: 00A9E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A9E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A9E773
Sleep.KERNEL32(000000FA), ref: 00A9E77E
IsWindow.USER32 ref: 00A9E78A
EndDialog.USER32(00000000), ref: 00A9E79B

Strings

BUTTON, xrefs: 00A9E719

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 5510dd64523bcf34d280fc27eae1c7ec219f604320588831b1bab890dc9ce406
Instruction ID: 2012eca50242185ab48fd865ebb3717b1dff20381dc52e52d0ba49bc16ab5fee
Opcode Fuzzy Hash: 5510dd64523bcf34d280fc27eae1c7ec219f604320588831b1bab890dc9ce406
Instruction Fuzzy Hash: 14218CB0300205BFEF00EFA4ED8DE263BA9FB64758B151824F509825B2DF72AC558B25

Function 00A9E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A9EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A9EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A9EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A9EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A9EAA7

Strings

play PlayMe wait, xrefs: 00A9EA91
open , xrefs: 00A9EA0C
status PlayMe mode, xrefs: 00A9EA58
alias PlayMe, xrefs: 00A9EA36
close PlayMe, xrefs: 00A9EA6E, 00A9EA9B
play PlayMe, xrefs: 00A9EAA2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 4057da5bc445ad8e095287f18ac2b20575fa02e931095d8d9f7ffebb23d9a3a8
Instruction ID: 7361cdc2725cff95ba365290a26858030acd703e9df9df81503a1a5f72ed22e2
Opcode Fuzzy Hash: 4057da5bc445ad8e095287f18ac2b20575fa02e931095d8d9f7ffebb23d9a3a8
Instruction Fuzzy Hash: 99112131A9025D79DB20E7A2DD8AEFF6ABCFBD5B40F400829B511A60D1EAB05945C6B0

Function 00A99F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A9A012
SetKeyboardState.USER32(?), ref: 00A9A07D
GetAsyncKeyState.USER32(000000A0), ref: 00A9A09D
GetKeyState.USER32(000000A0), ref: 00A9A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00A9A0E3
GetKeyState.USER32(000000A1), ref: 00A9A0F4
GetAsyncKeyState.USER32(00000011), ref: 00A9A120
GetKeyState.USER32(00000011), ref: 00A9A12E
GetAsyncKeyState.USER32(00000012), ref: 00A9A157
GetKeyState.USER32(00000012), ref: 00A9A165
GetAsyncKeyState.USER32(0000005B), ref: 00A9A18E
GetKeyState.USER32(0000005B), ref: 00A9A19C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0ac5cc81bcafe2f01b41936818ac37c93f708d5d3f25ef14aaecbdef649e046a
Instruction ID: 4dc656e18ed6c21edf65590ed11768bde3aad7018f2501c91d60d66fdeab777c
Opcode Fuzzy Hash: 0ac5cc81bcafe2f01b41936818ac37c93f708d5d3f25ef14aaecbdef649e046a
Instruction Fuzzy Hash: DD51B920B0478829FF35DBA489117EBFFF49F21384F08859ED5C6571C2DA549A4CC7A2

Function 00A95CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A95CE2
GetWindowRect.USER32(00000000,?), ref: 00A95CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00A95D59
GetDlgItem.USER32(?,00000002), ref: 00A95D69
GetWindowRect.USER32(00000000,?), ref: 00A95D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00A95DCF
GetDlgItem.USER32(?,000003E9), ref: 00A95DDD
GetWindowRect.USER32(00000000,?), ref: 00A95DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00A95E31
GetDlgItem.USER32(?,000003EA), ref: 00A95E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A95E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00A95E67

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7336dc9fe1278275a99f978122e030e2cd533930f56f913b4ea3fc40a90b9516
Instruction ID: 9e9df1251d4eb0614f6e992e2e38c213085709ae9657521a4b3c4173d5824458
Opcode Fuzzy Hash: 7336dc9fe1278275a99f978122e030e2cd533930f56f913b4ea3fc40a90b9516
Instruction Fuzzy Hash: F751FCB1F00605AFDF19CFA8DD8AAAEBBF5EB48310F158129F519E6290D7709E05CB50

Function 00A48BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A48F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A48BE8,?,00000000,?,?,?,?,00A48BBA,00000000,?), ref: 00A48FC5

DestroyWindow.USER32(?), ref: 00A48C81
KillTimer.USER32(00000000,?,?,?,?,00A48BBA,00000000,?), ref: 00A48D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00A86973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00A48BBA,00000000,?), ref: 00A869A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00A48BBA,00000000,?), ref: 00A869B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00A48BBA,00000000), ref: 00A869D4
DeleteObject.GDI32(00000000), ref: 00A869E6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 5a83ffb2f15a4f7a0be20947f8b002c738a6c07faea445e68daa194b3e75338f
Instruction ID: 1d94cc2c014f2570bd1d12eb89826c2b1ab85fbfa19e9f5ddc0a97b59a1f1514
Opcode Fuzzy Hash: 5a83ffb2f15a4f7a0be20947f8b002c738a6c07faea445e68daa194b3e75338f
Instruction Fuzzy Hash: 21616E35502710DFDB29DF18EA88B29B7F1FB90316F14491CE0469B5A0CB79A992DF90

Function 00A49838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00A49944: GetWindowLongW.USER32(?,000000EB), ref: 00A49952

GetSysColor.USER32(0000000F), ref: 00A49862

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 301869799cfe57846c8a94b8b6eeebf218c699c2355ed1ec453949d79a0f21c6
Instruction ID: 8b7225886c81104dd22ee331de3820b87d487448f50e1c1e0de89693330e2c01
Opcode Fuzzy Hash: 301869799cfe57846c8a94b8b6eeebf218c699c2355ed1ec453949d79a0f21c6
Instruction Fuzzy Hash: 8341A035104644AFDB209F7C9C88FBB3BA5AB86331F294615FAA6871E2D731DC52DB10

Function 00A996E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00A7F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00A99717
LoadStringW.USER32(00000000,?,00A7F7F8,00000001), ref: 00A99720

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00A7F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00A99742
LoadStringW.USER32(00000000,?,00A7F7F8,00000001), ref: 00A99745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00A99866

Strings

Line %d:, xrefs: 00A997A0
%s (%d) : ==> %s: %s %s, xrefs: 00A9984A
^ ERROR, xrefs: 00A997FB
Error: , xrefs: 00A9981D
Line %d (File "%s"):, xrefs: 00A9978F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 9b24a8f3b4e7168ea3db2952566e44c3d6aeba02c81baab47549f76a51a1cc43
Instruction ID: 220c32a751cf676bd61428b1eaa060341063ce3d51be21993004d3b58769c81e
Opcode Fuzzy Hash: 9b24a8f3b4e7168ea3db2952566e44c3d6aeba02c81baab47549f76a51a1cc43
Instruction Fuzzy Hash: A4413872904209BACF04EBE4CF86EEFB7B8AF55340F104429F60576092EB656F49CB61

Function 00A906DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A907A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A907BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A907DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A90804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00A9082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A90837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A9083C

Strings

\IPC$, xrefs: 00A90784
SOFTWARE\Classes\, xrefs: 00A9070E
\CLSID, xrefs: 00A90724

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 70b5020873bad62e022f1236e3ebe0fc53add84e8e21004cd77c21c1ee7a4c85
Instruction ID: d149678c219d6df8389a6e96b11c553a5461a599a59f0a0d0a043b763da2cdf3
Opcode Fuzzy Hash: 70b5020873bad62e022f1236e3ebe0fc53add84e8e21004cd77c21c1ee7a4c85
Instruction Fuzzy Hash: 34411572D10229AFCF15EBA4DD85DEEB7B8BF44350F058129F905A7160EB709E04CBA0

Function 00AC3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00AC403B
CreateCompatibleDC.GDI32(00000000), ref: 00AC4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00AC4055
SelectObject.GDI32(00000000,00000000), ref: 00AC405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00AC4068
DeleteDC.GDI32(00000000), ref: 00AC4072
GetWindowLongW.USER32(?,000000EC), ref: 00AC407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00AC4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00AC409E

Strings

static, xrefs: 00AC3FD3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: d5d6bcece558f8ccb503e15352ead9645845713d7cbd0ced16a9d7fc80ddfa7d
Instruction ID: b84f99c9471700b0c0867b5a606d13bb666c196be317d705547f3fa2e58d69bd
Opcode Fuzzy Hash: d5d6bcece558f8ccb503e15352ead9645845713d7cbd0ced16a9d7fc80ddfa7d
Instruction Fuzzy Hash: ED315C32541219BBDF219FA4CC49FDA3BA8FF0D320F120215FA19A61A0C775D811DB94

Function 00AB3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AB3C5C
CoInitialize.OLE32(00000000), ref: 00AB3C8A
CoUninitialize.OLE32 ref: 00AB3C94
_wcslen.LIBCMT ref: 00AB3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00AB3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00AB3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00AB3F0E
CoGetObject.OLE32(?,00000000,00ACFB98,?), ref: 00AB3F2D
SetErrorMode.KERNEL32(00000000), ref: 00AB3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00AB3FC4
VariantClear.OLEAUT32(?), ref: 00AB3FD8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 60c49094e5c93133fdb9cfa33cd76424e9411c3e24a4c77691f844ec15f7197e
Instruction ID: 3c4671c112d1b3e4883d38c75061d409a1b435d4f2bdd817de792a7c7eb6f575
Opcode Fuzzy Hash: 60c49094e5c93133fdb9cfa33cd76424e9411c3e24a4c77691f844ec15f7197e
Instruction Fuzzy Hash: 0CC147726083059FCB00DF68C98496BBBE9FF89744F14491DF98A9B212DB31EE05CB52

Function 00AA7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AA7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00AA7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00AA7BA3
CoCreateInstance.OLE32(00ACFD08,00000000,00000001,00AF6E6C,?), ref: 00AA7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00AA7C74
CoTaskMemFree.OLE32(?,?), ref: 00AA7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00AA7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00AA7D7A
CoTaskMemFree.OLE32(00000000), ref: 00AA7D81
CoTaskMemFree.OLE32(00000000), ref: 00AA7DD6
CoUninitialize.OLE32 ref: 00AA7DDC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 3cf34af62ee61f74eb29465316dd5f440c31c16e48d5e77c23868085e20ff1a3
Instruction ID: 32de1eac0a4fec0c861bd6cfaa1f93f0c3211dad0ccbf56c3691445751e261ec
Opcode Fuzzy Hash: 3cf34af62ee61f74eb29465316dd5f440c31c16e48d5e77c23868085e20ff1a3
Instruction Fuzzy Hash: 8AC11B75A04209AFCB14DFA4C984DAEBBF9FF49314F148499F81A9B261D730ED45CB90

Function 00AC541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00AC5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00AC5515
CharNextW.USER32(00000158), ref: 00AC5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00AC5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00AC559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00AC55AC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 80830d40721e3dbadbe7204db1846fdf39c2d09b2bf4cec4e9ee7141dafe9c87
Instruction ID: 390708842b042ec51289c1a5a087760735ed08d66adba1cfacd083105bf29cc1
Opcode Fuzzy Hash: 80830d40721e3dbadbe7204db1846fdf39c2d09b2bf4cec4e9ee7141dafe9c87
Instruction Fuzzy Hash: 96617E30D00608AFDF14CFA4CD84EFE7BB9EB05720F128549F525AA291D774AAC1DB60

Function 00A8FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A8FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00A8FB08
VariantInit.OLEAUT32(?), ref: 00A8FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A8FB3A
VariantCopy.OLEAUT32(?,?), ref: 00A8FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A8FBA1
VariantClear.OLEAUT32(?), ref: 00A8FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00A8FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A8FBCC
VariantClear.OLEAUT32(?), ref: 00A8FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A8FBE9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 3c8ed0bc1b3d1118b2084cb8cb1d344789b2f3422870c7f3bb964fd9820ea0eb
Instruction ID: 2f800c84fd1dde3444496dde0ba770c588461bc664afe06968f45dcfac4b5041
Opcode Fuzzy Hash: 3c8ed0bc1b3d1118b2084cb8cb1d344789b2f3422870c7f3bb964fd9820ea0eb
Instruction Fuzzy Hash: AF413235A0021ADFCF04EFA8D958DADBBB9FF48354F018065F956A7261DB30A946CF90

Function 00A99C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A99CA1
GetAsyncKeyState.USER32(000000A0), ref: 00A99D22
GetKeyState.USER32(000000A0), ref: 00A99D3D
GetAsyncKeyState.USER32(000000A1), ref: 00A99D57
GetKeyState.USER32(000000A1), ref: 00A99D6C
GetAsyncKeyState.USER32(00000011), ref: 00A99D84
GetKeyState.USER32(00000011), ref: 00A99D96
GetAsyncKeyState.USER32(00000012), ref: 00A99DAE
GetKeyState.USER32(00000012), ref: 00A99DC0
GetAsyncKeyState.USER32(0000005B), ref: 00A99DD8
GetKeyState.USER32(0000005B), ref: 00A99DEA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: cee675aa4a0a4211ae95f6800b1daca8711cb0b35280d0d3c53f36ff543a2326
Instruction ID: 21a428a93b53e1c6b019c47abe3e97bc4cc6b0178d27abb81543b8894050804a
Opcode Fuzzy Hash: cee675aa4a0a4211ae95f6800b1daca8711cb0b35280d0d3c53f36ff543a2326
Instruction Fuzzy Hash: A541A6347047C97DFF3197A888447B7BEE06F12354F08805EDAC65A5C2EBA599C8C7A2

Function 00AB055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00AB05BC
inet_addr.WSOCK32(?), ref: 00AB061C
gethostbyname.WSOCK32(?), ref: 00AB0628
IcmpCreateFile.IPHLPAPI ref: 00AB0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00AB06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00AB06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00AB07B9
WSACleanup.WSOCK32 ref: 00AB07BF

Strings

Ping, xrefs: 00AB0676

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 3cfc63377ec18a1d1690b94a229d9a68406ac9f40adb49341a2bcfbec87a773f
Instruction ID: 2dbfb28a1fd0b00318501770042fd145e737dfcaff2d79ab144f2fc4276bd9d8
Opcode Fuzzy Hash: 3cfc63377ec18a1d1690b94a229d9a68406ac9f40adb49341a2bcfbec87a773f
Instruction Fuzzy Hash: 69919D356046019FD720CF15C988F5BBBE8EF84318F1585A9F46A8B6A2CB70EC81CF91

Function 00AB8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00AB8CF3

Part of subcall function 00A98E54: _wcslen.LIBCMT ref: 00A98E77

_wcslen.LIBCMT ref: 00AB8D4E
_wcslen.LIBCMT ref: 00AB8D9C
_wcslen.LIBCMT ref: 00AB8DDC
_wcslen.LIBCMT ref: 00AB8E6E

Strings

winapi, xrefs: 00AB8D96, 00AB8D9B
cdecl, xrefs: 00AB8D48, 00AB8D4D
none, xrefs: 00AB8E65, 00AB8E6A
stdcall, xrefs: 00AB8DD6, 00AB8DDB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 1b0601c8073d2535a4e8d16f07b2ad27ab971992b323eac077755cbb57953e4d
Instruction ID: 4f4009614954e0686bbb4efd125d38bc12e7386a2810bbd88f5e53da7a1a61fb
Opcode Fuzzy Hash: 1b0601c8073d2535a4e8d16f07b2ad27ab971992b323eac077755cbb57953e4d
Instruction Fuzzy Hash: F3519131A041169BCF14DF6CC9519FEB7ADBF64724B20422AF926E7286DB39DD40C790

Function 00AB372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00AB3774
CoUninitialize.OLE32 ref: 00AB377F
CoCreateInstance.OLE32(?,00000000,00000017,00ACFB78,?), ref: 00AB37D9
IIDFromString.OLE32(?,?), ref: 00AB384C
VariantInit.OLEAUT32(?), ref: 00AB38E4
VariantClear.OLEAUT32(?), ref: 00AB3936

Strings

Invalid parameter, xrefs: 00AB3865
NULL Pointer assignment, xrefs: 00AB381E
Failed to create object, xrefs: 00AB37E4, 00AB389A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 2b2317509830027d59e5f37824d73679ec7f55717115f15e2b82d782406f71b3
Instruction ID: 2c06cca4356f4f2fde85dc5e24e2ed7762dfaa988d473cc1df286e6be7408f00
Opcode Fuzzy Hash: 2b2317509830027d59e5f37824d73679ec7f55717115f15e2b82d782406f71b3
Instruction Fuzzy Hash: E8619372608311AFDB10DF94C949FAAB7E8EF45710F10481DF58597292D770EE49CB92

Function 00AA3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00AA33CF

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00AA33F0

Strings

Error: , xrefs: 00AA34D1
Line %d (File "%s"):, xrefs: 00AA3443, 00AA345C
Incorrect parameters to object property !, xrefs: 00AA34AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00AA3504
"%s" (%d) : ==> %s:, xrefs: 00AA3522
^ ERROR , xrefs: 00AA349E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: ad9018d7228de50431eef3c837fa430e23f3452ffbd3b539e460c48d7814bdc3
Instruction ID: 0a001ef06b8eaa8eb7df581583c98f2c5f418ac7335da19ff83f07df971cc0dd
Opcode Fuzzy Hash: ad9018d7228de50431eef3c837fa430e23f3452ffbd3b539e460c48d7814bdc3
Instruction Fuzzy Hash: CA518D72940209BADF15EBE4CE46EEEB7B8AF14340F108465F505730A2EB712F58DB61

Function 00A9B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A9B5FC
_wcslen.LIBCMT ref: 00A9B608
_wcslen.LIBCMT ref: 00A9B64D
_wcslen.LIBCMT ref: 00A9B68C
_wcslen.LIBCMT ref: 00A9B6C7

Strings

EXISTS, xrefs: 00A9B686, 00A9B68B
KEYS, xrefs: 00A9B647, 00A9B64C
REMOVE, xrefs: 00A9B602, 00A9B607
APPEND, xrefs: 00A9B6C1, 00A9B6C6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: b92e8e07ef8314885e787a638ba985278fce98de08eab4a9750abfa735751f24
Instruction ID: ffdee7bbd765c0452fe8bf7b0bd62cfb7b25d5809358e18ec22c4bfdcba72a92
Opcode Fuzzy Hash: b92e8e07ef8314885e787a638ba985278fce98de08eab4a9750abfa735751f24
Instruction Fuzzy Hash: B241E632B110269BCF106FBD9E905BE77F5BFA0754B244629E621DB284E731ED81C7A0

Function 00AA5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AA53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00AA5416
GetLastError.KERNEL32 ref: 00AA5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00AA54A7

Strings

INVALID, xrefs: 00AA5459
READY, xrefs: 00AA5460, 00AA5468
NOTREADY, xrefs: 00AA544B
UNKNOWN, xrefs: 00AA5444
READONLY, xrefs: 00AA5452

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 692bc799464914acaab98666fa0e614bab054d30d582ebcef52b9b7279fe3f05
Instruction ID: 5f3e559fb32434546080149323743ca86eff0a60b06aa2c1deb7e14e1aca8931
Opcode Fuzzy Hash: 692bc799464914acaab98666fa0e614bab054d30d582ebcef52b9b7279fe3f05
Instruction Fuzzy Hash: FF31B035E006089FDB10DFB8C584EAABBB5EF5A305F188069F506DB292D771DD86CB90

Function 00AC3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00AC3C79
SetMenu.USER32(?,00000000), ref: 00AC3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AC3D10
IsMenu.USER32(?), ref: 00AC3D24
CreatePopupMenu.USER32 ref: 00AC3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00AC3D5B
DrawMenuBar.USER32 ref: 00AC3D63

Strings

F, xrefs: 00AC3D4E
0, xrefs: 00AC3C54

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 93b41e838e847ff993d87304c65c8f508e59e7dea9cc004716cb107e255705f9
Instruction ID: e4cdf9fe3cea39e5a3772a681bbb638d1a46ed850ca1e35bff3d666d6c8ad3eb
Opcode Fuzzy Hash: 93b41e838e847ff993d87304c65c8f508e59e7dea9cc004716cb107e255705f9
Instruction Fuzzy Hash: 9041367AA01209EFDF14CFA4D844FAA7BB5FF49350F15442DE94AA7360D730AA11CB94

Function 00A91EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00A91F64
GetDlgCtrlID.USER32 ref: 00A91F6F
GetParent.USER32 ref: 00A91F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A91F8E
GetDlgCtrlID.USER32(?), ref: 00A91F97
GetParent.USER32(?), ref: 00A91FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A91FAE

Strings

ListBox, xrefs: 00A91F21
ComboBox, xrefs: 00A91EEC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 841a0e47f5704581dbd0088bfceaf1827ac425ca771e6081ea4489810e613fd0
Instruction ID: 8e87ba2ad7146b7410e6599c8dab3e283a2db6ccb37dfbd741ca46583e60bbbb
Opcode Fuzzy Hash: 841a0e47f5704581dbd0088bfceaf1827ac425ca771e6081ea4489810e613fd0
Instruction Fuzzy Hash: F321BE75A00218BBCF05EFA0CD85DFEBBB8EF05310F001516F965A72A1DB795909DB60

Function 00A91FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00A92043
GetDlgCtrlID.USER32 ref: 00A9204E
GetParent.USER32 ref: 00A9206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A9206D
GetDlgCtrlID.USER32(?), ref: 00A92076
GetParent.USER32(?), ref: 00A9208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A9208D

Strings

ListBox, xrefs: 00A92002
ComboBox, xrefs: 00A91FCD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 7edecb23c14deca777a3340131f9c21a47bcf79377b0fb8a89e6a4133a2989fb
Instruction ID: 2e07370325a448555a225f4af2a3a50cb04e9e3ff8445ab2ccce06dd0b123f34
Opcode Fuzzy Hash: 7edecb23c14deca777a3340131f9c21a47bcf79377b0fb8a89e6a4133a2989fb
Instruction Fuzzy Hash: 0121A175E40218BBCF10EFA0CD85EFEBBB8EF05350F005415F955A72A1DA794919DB60

Function 00AC3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00AC3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00AC3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00AC3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00AC3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00AC3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00AC3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00AC3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00AC3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00AC3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00AC3C13

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 1c653302f69f1b3534668667f414bfff7adeee239dec7e4884febafed78213f1
Instruction ID: 52e63af85163942b8a0c207f1ea79d7a29df1da9fb5466381fbd27324aa7e414
Opcode Fuzzy Hash: 1c653302f69f1b3534668667f414bfff7adeee239dec7e4884febafed78213f1
Instruction Fuzzy Hash: 95616875A00208AFDB10DFA8CD81FEE77B8EB09710F114199FA15AB2A1D774AE46DB50

Function 00A9B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A9B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B165
GetWindowThreadProcessId.USER32(00000000), ref: 00A9B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A9B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00A9A1E1,?,00000001), ref: 00A9B21D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 6ff4bd46d644ae353e5a5c0e5522bf4e39442de73b7e22574a6c976643151e95
Instruction ID: 3795afba72d5d0b3b6d20cefa223ec2cf253ec0b39eceaf92bc8bfbdc82bb881
Opcode Fuzzy Hash: 6ff4bd46d644ae353e5a5c0e5522bf4e39442de73b7e22574a6c976643151e95
Instruction Fuzzy Hash: E5317C75610204AFDF10DF64EE98FA97BEDEB61721F114105FA05D71A0EBB4AA428F70

Function 00A62C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A62C94

Part of subcall function 00A629C8: HeapFree.KERNEL32(00000000,00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000), ref: 00A629DE
Part of subcall function 00A629C8: GetLastError.KERNEL32(00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000,00000000), ref: 00A629F0

_free.LIBCMT ref: 00A62CA0
_free.LIBCMT ref: 00A62CAB
_free.LIBCMT ref: 00A62CB6
_free.LIBCMT ref: 00A62CC1
_free.LIBCMT ref: 00A62CCC
_free.LIBCMT ref: 00A62CD7
_free.LIBCMT ref: 00A62CE2
_free.LIBCMT ref: 00A62CED
_free.LIBCMT ref: 00A62CFB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 41d9efa1fb17b2421c681dc2cedb7b1681f1d6de8f23539b18c3c6d09f840700
Instruction ID: 770998f282e1d5cd3e4e4c8591b9df1ecef0ee2777e791fbbbb2d1648568833c
Opcode Fuzzy Hash: 41d9efa1fb17b2421c681dc2cedb7b1681f1d6de8f23539b18c3c6d09f840700
Instruction Fuzzy Hash: 9111A476600508BFCB06EF54DA82EDD3BB5FF85390F4144A5FA489F222DA31EE509B90

Function 00A31410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00A31459
OleUninitialize.OLE32(?,00000000), ref: 00A314F8
UnregisterHotKey.USER32(?), ref: 00A316DD
DestroyWindow.USER32(?), ref: 00A724B9
FreeLibrary.KERNEL32(?), ref: 00A7251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A7254B

Strings

close all, xrefs: 00A31454

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: d7da564ba0c79a17b263276881a51d747ad7685ff077b81f427aa6e9b9852954
Instruction ID: 76bb827d60ba87fad20dcfc4b604ebd5ae94113aa6872f351b6c16aec5070290
Opcode Fuzzy Hash: d7da564ba0c79a17b263276881a51d747ad7685ff077b81f427aa6e9b9852954
Instruction Fuzzy Hash: BED18A31701212CFCB29EF55C999B29F7A4BF45710F1582ADF44AAB252DB30AD12CF91

Function 00AA7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AA7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA7FC1
GetFileAttributesW.KERNEL32(?), ref: 00AA7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00AA8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00AA8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AA80B0

Strings

*.*, xrefs: 00AA8066

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 35b2e889d2144af33ba7dc803968fe9bceec567025b6fd13d4b8561ad204055c
Instruction ID: 581361e1921bcdcc613b64ce617d62497e7157a24ace2be0d2e008e4a37bb6ae
Opcode Fuzzy Hash: 35b2e889d2144af33ba7dc803968fe9bceec567025b6fd13d4b8561ad204055c
Instruction Fuzzy Hash: 83819D725083419BCB30EF14C9449AFB3E8BF8A310F544C6AF889D7291EB35DD498B92

Function 00A35BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00A35C7A

Part of subcall function 00A35D0A: GetClientRect.USER32(?,?), ref: 00A35D30
Part of subcall function 00A35D0A: GetWindowRect.USER32(?,?), ref: 00A35D71
Part of subcall function 00A35D0A: ScreenToClient.USER32(?,?), ref: 00A35D99

GetDC.USER32 ref: 00A746F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00A74708
SelectObject.GDI32(00000000,00000000), ref: 00A74716
SelectObject.GDI32(00000000,00000000), ref: 00A7472B
ReleaseDC.USER32(?,00000000), ref: 00A74733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00A747C4

Strings

U, xrefs: 00A74693

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 43999d9dabfedd73d1c6f194cff73eb8e9bfa169513ee1a123cd613355d3f2c7
Instruction ID: aa4bf37a79d9d7d34ade0ec6dc61e8b0fc1be3fec5b94ee97978370657d2b9c6
Opcode Fuzzy Hash: 43999d9dabfedd73d1c6f194cff73eb8e9bfa169513ee1a123cd613355d3f2c7
Instruction Fuzzy Hash: 0971DF30900205DFCF2ACF68CD85ABA7BB5FF4A364F18C269F9595A166C7319841DF50

Function 00AA359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00AA35E4

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

LoadStringW.USER32(00B02390,?,00000FFF,?), ref: 00AA360A

Strings

^ ERROR, xrefs: 00AA36C9
Error: , xrefs: 00AA36EF
Line %d (File "%s"):, xrefs: 00AA366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00AA3724
"%s" (%d) : ==> %s:, xrefs: 00AA3742

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 2fc6a8a90677a1b7d8b8618cb446906d53d01f0e675df99e50994774a03b789a
Instruction ID: ca243f3e0d14a52228dad5474dcf9d344683828c53eb779dda1a56f9b0c11129
Opcode Fuzzy Hash: 2fc6a8a90677a1b7d8b8618cb446906d53d01f0e675df99e50994774a03b789a
Instruction Fuzzy Hash: BD515972904209BBCF15EBE0CE42EEEBB78AF15300F144129F105771A1EB712A99DFA1

Function 00AAC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00AAC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AAC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00AAC2CA
GetLastError.KERNEL32 ref: 00AAC322
SetEvent.KERNEL32(?), ref: 00AAC336
InternetCloseHandle.WININET(00000000), ref: 00AAC341

Strings

, xrefs: 00AAC2BB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f8e580db35d733131392856b9653f3ba371c383bbfb45f67c0a5f2124c3ed05b
Instruction ID: 8ba1c375dc5d5f0f2fb0dbcfa0d59dd6c1cfd6ba50b160c72d86a470ba979d85
Opcode Fuzzy Hash: f8e580db35d733131392856b9653f3ba371c383bbfb45f67c0a5f2124c3ed05b
Instruction Fuzzy Hash: D5316F71500304AFEB21DFA48988AABBAFCEB4A764F14851DF44A97280DB34DD059B70

Function 00A9989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00A73AAF,?,?,Bad directive syntax error,00ACCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00A998BC
LoadStringW.USER32(00000000,?,00A73AAF,?), ref: 00A998C3

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00A99987

Strings

Line %d:, xrefs: 00A99912
., xrefs: 00A9996D
%s (%d) : ==> %s.: %s %s, xrefs: 00A998F1
Line %d (File "%s"):, xrefs: 00A9992D
Error: , xrefs: 00A99955

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 1c2cb64532e47521a84e7afb0ab747d1383e01ebebf7f1e5fed1739bb8fa55c0
Instruction ID: 18408a541649caf8cfd12e65fb30e5fd4dffd78b79e4f7c36615a753b385c1e7
Opcode Fuzzy Hash: 1c2cb64532e47521a84e7afb0ab747d1383e01ebebf7f1e5fed1739bb8fa55c0
Instruction Fuzzy Hash: 17215A3294421EBBCF15AFD0CD0AEEE7779FF18300F044869F619660A2EB719A18DB51

Function 00A9209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A920AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00A920C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A9214D

Strings

SHELLDLL_DefView, xrefs: 00A920CC
smallicons, xrefs: 00A92115
list, xrefs: 00A9212F
details, xrefs: 00A920FB
largeicons, xrefs: 00A920E1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: cab6bda6bfab5d67e1aa82b99f5755a8a1da75f4379ec917483b66679637c08f
Instruction ID: 7b333167e82645af323981c3d8774e75de045366a78563b0ad24b056232d8600
Opcode Fuzzy Hash: cab6bda6bfab5d67e1aa82b99f5755a8a1da75f4379ec917483b66679637c08f
Instruction Fuzzy Hash: 6311E37AB8870ABAFA016374EC0AEB637DCEB08369B300216FB04A50D1FA7168565714

Function 00A68D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df407c20e6cb4052a1751fc4673747c48205a0588d30b4405e90e72423fc97d
Instruction ID: c8ce876f4bdb2b7fd44285ad5c367dd924484f25978f8d63c93df05b417e4831
Opcode Fuzzy Hash: 1df407c20e6cb4052a1751fc4673747c48205a0588d30b4405e90e72423fc97d
Instruction Fuzzy Hash: F1C1F3B4E04249AFDF11DFA8D841BEEBBB8BF19310F054199E915A7392CB349941CB61

Function 00A6CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00A6CEB7
_free.LIBCMT ref: 00A6CF22
_free.LIBCMT ref: 00A6CF48
_free.LIBCMT ref: 00A6CF71
_free.LIBCMT ref: 00A6CFA9
_free.LIBCMT ref: 00A6CFDA
_free.LIBCMT ref: 00A6D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00A6D09C
_free.LIBCMT ref: 00A6D0B5

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 948dcd47e6044687e5bb658e7739807bf4b1f6cc5e3b04c791afe5152b3b4c49
Instruction ID: 65bf05cc64b66ba2180d436c1fb43f331a9d4da6789c7a0021dd27f832d06232
Opcode Fuzzy Hash: 948dcd47e6044687e5bb658e7739807bf4b1f6cc5e3b04c791afe5152b3b4c49
Instruction Fuzzy Hash: 20614B71A04701AFDF25AFB89D81B7D7BB5EF05370F05426DF98597281DA329D0187A0

Function 00AC50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00AC5186
ShowWindow.USER32(?,00000000), ref: 00AC51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00AC51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00AC51D1

Part of subcall function 00AC6FBA: DeleteObject.GDI32(00000000), ref: 00AC6FE6

GetWindowLongW.USER32(?,000000F0), ref: 00AC520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AC521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00AC524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00AC5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00AC5296

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 953aef6ea0393b35351792d9cc696cbe3af131ea41bfa9ca238a0a3080024878
Instruction ID: 9097f1501c915497630a53cdae91c5f968c356a80ac47961d1899b719a499408
Opcode Fuzzy Hash: 953aef6ea0393b35351792d9cc696cbe3af131ea41bfa9ca238a0a3080024878
Instruction Fuzzy Hash: 2851CE30E40A08BEEF20AF74CC4AFD97BA5EB04320F5A4209F619962E0C775B9D0DB40

Function 00A48B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00A86890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00A868A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00A868B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00A868D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00A868F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00A48874,00000000,00000000,00000000,000000FF,00000000), ref: 00A86901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00A8691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00A48874,00000000,00000000,00000000,000000FF,00000000), ref: 00A8692D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 9aeedb1398ee469332faa5ead575b16777fed540ec8b25b6b4c8ce50f83c5f8b
Instruction ID: 8008f707903a23b78cdf09553638678e316de300b0af05c89275d2bc0d0cbdae
Opcode Fuzzy Hash: 9aeedb1398ee469332faa5ead575b16777fed540ec8b25b6b4c8ce50f83c5f8b
Instruction Fuzzy Hash: 0A519A74A00209EFEB24DF28DC55FAE7BB5FB98760F104518F906972A0DB74E992DB40

Function 00AAC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00AAC182
GetLastError.KERNEL32 ref: 00AAC195
SetEvent.KERNEL32(?), ref: 00AAC1A9

Part of subcall function 00AAC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00AAC272
Part of subcall function 00AAC253: GetLastError.KERNEL32 ref: 00AAC322
Part of subcall function 00AAC253: SetEvent.KERNEL32(?), ref: 00AAC336
Part of subcall function 00AAC253: InternetCloseHandle.WININET(00000000), ref: 00AAC341

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 0126d408a38e9e06b71e65226a8bb2ac3ec7996073a1b37e60ab1528ffe1cf31
Instruction ID: 5afd35219ff8d07e9dbb772af140298f50169a04678bf9ab63ff9828aabd5507
Opcode Fuzzy Hash: 0126d408a38e9e06b71e65226a8bb2ac3ec7996073a1b37e60ab1528ffe1cf31
Instruction Fuzzy Hash: 1431BE71200705AFEB21AFE5DD04BA6BBF8FF1A320B04451EF95A87650D731E819DBA0

Function 00A925A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A93A57
Part of subcall function 00A93A3D: GetCurrentThreadId.KERNEL32 ref: 00A93A5E
Part of subcall function 00A93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A925B3), ref: 00A93A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A925BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A925DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00A925DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A925E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A92601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00A92605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A9260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A92623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00A92627

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: dae240550391b2f2d60423ed746ba665f756bbd1e3146f2cae4f071f1d076df5
Instruction ID: 38a6f740ae77b2b4510e28f12a0bd774d28dc7bc3232a15dc777876cf5d7eb55
Opcode Fuzzy Hash: dae240550391b2f2d60423ed746ba665f756bbd1e3146f2cae4f071f1d076df5
Instruction Fuzzy Hash: 8501D831790220BBFF10A7A99C8AF593FA9DB4EB61F120011F318AE1D1C9E214458A69

Function 00A91803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00A91449,?,?,00000000), ref: 00A9180C
HeapAlloc.KERNEL32(00000000,?,00A91449,?,?,00000000), ref: 00A91813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A91449,?,?,00000000), ref: 00A91828
GetCurrentProcess.KERNEL32(?,00000000,?,00A91449,?,?,00000000), ref: 00A91830
DuplicateHandle.KERNEL32(00000000,?,00A91449,?,?,00000000), ref: 00A91833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A91449,?,?,00000000), ref: 00A91843
GetCurrentProcess.KERNEL32(00A91449,00000000,?,00A91449,?,?,00000000), ref: 00A9184B
DuplicateHandle.KERNEL32(00000000,?,00A91449,?,?,00000000), ref: 00A9184E
CreateThread.KERNEL32(00000000,00000000,00A91874,00000000,00000000,00000000), ref: 00A91868

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: e560842261ee7a2b5a657745e57a3cd3752773dd8bd07978fd0017c4f04230ac
Instruction ID: 4612fc91f959eca097b5445d2d3613385ec5e9d0d0625aeba16448002a19dc1c
Opcode Fuzzy Hash: e560842261ee7a2b5a657745e57a3cd3752773dd8bd07978fd0017c4f04230ac
Instruction Fuzzy Hash: 0501BFB5240344BFE710EBA6DC4DF5B7BACEB89B11F054511FA05DB191C6749801CB20

Function 00ABA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00A9D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00A9D501
Part of subcall function 00A9D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00A9D50F
Part of subcall function 00A9D4DC: CloseHandle.KERNEL32(00000000), ref: 00A9D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ABA16D
GetLastError.KERNEL32 ref: 00ABA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ABA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00ABA268
GetLastError.KERNEL32(00000000), ref: 00ABA273
CloseHandle.KERNEL32(00000000), ref: 00ABA2C4

Strings

SeDebugPrivilege, xrefs: 00ABA18F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 9495c291650d45002f9c6903e44d6c8a526e260c09c6207682389b8e9e024723
Instruction ID: 7b2e2868e0c3023c00fac6f9c0998e3dbe1fa529976ef66a567abca034175754
Opcode Fuzzy Hash: 9495c291650d45002f9c6903e44d6c8a526e260c09c6207682389b8e9e024723
Instruction Fuzzy Hash: 23619F30204242AFD710DF19C894F95BBE5AF54318F18849CE46A4F7A3C772EC45CB92

Function 00AC3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00AC3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00AC393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00AC3954
_wcslen.LIBCMT ref: 00AC3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00AC39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00AC39F4

Strings

SysListView32, xrefs: 00AC38F7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 60a4a31e57c9b25d3e041f2b23a23cbd7a560a7e3cffc8ccb27e635b4755cfe5
Instruction ID: 6fbee302325ab696647a62ffb1284c265ca0599de919eb2bc635cae57dbeb2c8
Opcode Fuzzy Hash: 60a4a31e57c9b25d3e041f2b23a23cbd7a560a7e3cffc8ccb27e635b4755cfe5
Instruction Fuzzy Hash: C341A372A00219BBEF219F64CC45FEA7BA9FF08354F11452AF958E7281D7759A80CB90

Function 00A9BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A9BCFD
IsMenu.USER32(00000000), ref: 00A9BD1D
CreatePopupMenu.USER32 ref: 00A9BD53
GetMenuItemCount.USER32(01595118), ref: 00A9BDA4
InsertMenuItemW.USER32(01595118,?,00000001,00000030), ref: 00A9BDCC

Strings

0, xrefs: 00A9BCA8
2, xrefs: 00A9BD37

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 0344ba6d3c50ce47691801d82584d5e305e8e2000df491caf335f7400387dc44
Instruction ID: 016445a267bb9093e5cb1881453531c53fbf7c8c5307320294aa3fedb0fe14dd
Opcode Fuzzy Hash: 0344ba6d3c50ce47691801d82584d5e305e8e2000df491caf335f7400387dc44
Instruction Fuzzy Hash: 7D51BF70B10219DBDF10CFA8EA88BAEBBF4BF45324F144159E415EB291D7709941CB71

Function 00A9C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A9C913

Strings

info, xrefs: 00A9C8B4
blank, xrefs: 00A9C895
stop, xrefs: 00A9C8E4
question, xrefs: 00A9C8CC
warning, xrefs: 00A9C8FC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 6a409b701785dc6481fba490811b854ff1a1fb298bf457e6d78874fb9575aa85
Instruction ID: a5c89b4fde48d3e54aaf14bbeb12b188c1f883b991978867306e042cbaca2d92
Opcode Fuzzy Hash: 6a409b701785dc6481fba490811b854ff1a1fb298bf457e6d78874fb9575aa85
Instruction Fuzzy Hash: 92110D32789B0ABAEF05AB549C83CAA77ECEF15379B20442AFA04A6282D7705D405364

Function 00A9DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A9DE42
gethostname.WSOCK32(?,00000100), ref: 00A9DE5C
gethostbyname.WSOCK32(?), ref: 00A9DE69
inet_ntoa.WSOCK32(?), ref: 00A9DEAB
_strcat.LIBCMT ref: 00A9DEB9
WSACleanup.WSOCK32 ref: 00A9DEDE

Strings

0.0.0.0, xrefs: 00A9DE87

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 0d093a76321153fa5eeb17a10c3a46ef7a597d405d073d0388028a383387b9ea
Instruction ID: 6d5ef695b15b4a7f6ef67582c9b3a006f0c7d18f36f7ccf37cc315a18279db20
Opcode Fuzzy Hash: 0d093a76321153fa5eeb17a10c3a46ef7a597d405d073d0388028a383387b9ea
Instruction Fuzzy Hash: FD110671A04115BFCF20ABA09D4AEEF77FCEF14765F010169F509AA091EF708AC18A60

Function 00AC9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

GetSystemMetrics.USER32(0000000F), ref: 00AC9FC7
GetSystemMetrics.USER32(0000000F), ref: 00AC9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00ACA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00ACA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00ACA263
ShowWindow.USER32(00000003,00000000), ref: 00ACA282
InvalidateRect.USER32(?,00000000,00000001), ref: 00ACA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00ACA2CA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: fe848b39ed9f2a08670866a45ee49f0d70aa25b429ad9cb6122cfcf7279f10fc
Instruction ID: ac1b5fb7870884cc017ed42a42de335cafd11a9313a849ea3fe568e806c91b39
Opcode Fuzzy Hash: fe848b39ed9f2a08670866a45ee49f0d70aa25b429ad9cb6122cfcf7279f10fc
Instruction Fuzzy Hash: CFB1AA31600229DBDF14CF68C985BFA7BF2FF64715F0A8069EC499B295DB31A940CB51

Function 00A9ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A9ED2A
_wcslen.LIBCMT ref: 00A9ED3B
_wcslen.LIBCMT ref: 00A9ED79
_wcslen.LIBCMT ref: 00A9EDAF
_wcslen.LIBCMT ref: 00A9EDDF
_wcslen.LIBCMT ref: 00A9EDEF
_wcslen.LIBCMT ref: 00A9EE2B
_wcslen.LIBCMT ref: 00A9EE5A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: e8e4dbf57c6b5c7338cdaa6fc0b325f52c65ca8f29cbce6dca33196eaf9d7aab
Instruction ID: 0da912dcdf2b005646c85333f80eac980ac955b59e93de4f51775c5df11fd557
Opcode Fuzzy Hash: e8e4dbf57c6b5c7338cdaa6fc0b325f52c65ca8f29cbce6dca33196eaf9d7aab
Instruction Fuzzy Hash: F841B265D10218B5DB11EBF5888A9CFB7BCFF45311F508466E918E3122FB34E249C3A5

Function 00A4F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A8682C,00000004,00000000,00000000), ref: 00A4F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00A8682C,00000004,00000000,00000000), ref: 00A8F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A8682C,00000004,00000000,00000000), ref: 00A8F454

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 085e330e22461e75d63df22b3db069c83333465763e9d65e75bf9f466923c728
Instruction ID: c6ced7468b2614d9becb15c49fc3ccd29237a03daa815a24cff160639d81e172
Opcode Fuzzy Hash: 085e330e22461e75d63df22b3db069c83333465763e9d65e75bf9f466923c728
Instruction Fuzzy Hash: FD413A39208680BED7399F3CCD88B2A7BA1AFD6320F14643DE09B57562D731A881CB11

Function 00AC2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00AC2D1B
GetDC.USER32(00000000), ref: 00AC2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AC2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00AC2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00AC2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00AC2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00AC5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00AC2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00AC2DE1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 41b69b95a32c4a0cc5df480f71e450d43fe25452ce1a8c4cee6800ddce9ca99a
Instruction ID: bf90cf81034d4807f9535544cb3d8532fffc4317ebc091d390d6c37cef317ac6
Opcode Fuzzy Hash: 41b69b95a32c4a0cc5df480f71e450d43fe25452ce1a8c4cee6800ddce9ca99a
Instruction Fuzzy Hash: E231AE72201214BFEB118F54CC8AFEB3FADEF19721F094055FE099A291C6759C41CBA0

Function 00A95622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A95637
_memcmp.LIBVCRUNTIME ref: 00A95659
_memcmp.LIBVCRUNTIME ref: 00A95671
_memcmp.LIBVCRUNTIME ref: 00A95684
_memcmp.LIBVCRUNTIME ref: 00A9569E
_memcmp.LIBVCRUNTIME ref: 00A956B1
_memcmp.LIBVCRUNTIME ref: 00A956C9
_memcmp.LIBVCRUNTIME ref: 00A956E4

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 443e3be9bcc3f3c36dc90a41a3066eeae9926e2ef06b67046493914bdbb1c614
Instruction ID: e8a3c1f0c57d39f73528b783342952236c6dbb01d0318ec294c102895ccb9348
Opcode Fuzzy Hash: 443e3be9bcc3f3c36dc90a41a3066eeae9926e2ef06b67046493914bdbb1c614
Instruction Fuzzy Hash: D72195B1F45A097B9A165A319E93FBA33DDBF20395F480424FE049A581F730EE1483A5

Function 00AB4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00AB5007
NULL Pointer assignment, xrefs: 00AB502E, 00AB5383

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: d69ab3493e8af0b652d39a9c50f7ddfc214515e7bb67f41b340869d5603e5c2d
Instruction ID: a173d9e3bdfa1308aa7272089c4b9d59a9dcefc9ec334142debeed58dbeeb3a1
Opcode Fuzzy Hash: d69ab3493e8af0b652d39a9c50f7ddfc214515e7bb67f41b340869d5603e5c2d
Instruction Fuzzy Hash: 50D1BE71E0060AAFDF14DFA8D880BEEB7B9BF48354F148169E915AB282D771DD41CB90

Function 00A71522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00A715CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00A71651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A716E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00A716FB

Part of subcall function 00A63820: RtlAllocateHeap.NTDLL(00000000,?,00B01444,?,00A4FDF5,?,?,00A3A976,00000010,00B01440,00A313FC,?,00A313C6,?,00A31129), ref: 00A63852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A71777
__freea.LIBCMT ref: 00A717A2
__freea.LIBCMT ref: 00A717AE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: cf3fa6825a6f2a5e37d9caa3bc2cbfd724935f400fc38f8276600b3f5e7d5b7a
Instruction ID: 6c0613e018feeecf84fa39cdb71598febd2203c0818f6a4597410d4b86a06f23
Opcode Fuzzy Hash: cf3fa6825a6f2a5e37d9caa3bc2cbfd724935f400fc38f8276600b3f5e7d5b7a
Instruction Fuzzy Hash: D3919372E002169EDB288FA9CD81EEEBBF5AF45710F18C659E809E7141E735DD41CBA0

Function 00AB4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AB4648
VariantInit.OLEAUT32(?), ref: 00AB4749
VariantClear.OLEAUT32(?), ref: 00AB4753
VariantClear.OLEAUT32(?), ref: 00AB47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00AB472C
Null Object assignment in FOR..IN loop, xrefs: 00AB45D8, 00AB4706, 00AB47BE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 56aefee5be0816a25b5d9e2abddd7ea3f361f2a07ba9c136cc742454caaf2dfa
Instruction ID: 1bbab3b69818fd54f7d5f65b7a07b71d8bc775017fc0ebe9c86153a0112020e8
Opcode Fuzzy Hash: 56aefee5be0816a25b5d9e2abddd7ea3f361f2a07ba9c136cc742454caaf2dfa
Instruction Fuzzy Hash: 2A916F71A00219AFDF24CFA5C854FEEBBBCEF4A714F108559F505AB282DB709945CBA0

Function 00AA1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00AA125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00AA1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00AA12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AA12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AA135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AA13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AA1430

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 25717c1082ed60706ab3807f520b4833799cead39e0e8b3c2fd6808da1e7bdbd
Instruction ID: 121778303c362103a1e5f61ba7c817d64e346c4a7fa94ba3f5c823d9a5d3cfe0
Opcode Fuzzy Hash: 25717c1082ed60706ab3807f520b4833799cead39e0e8b3c2fd6808da1e7bdbd
Instruction Fuzzy Hash: 2591C075A00209AFDB00DFA8C885BBEB7B5FF46325F118029E951EB2D1D774E946CB90

Function 00A4948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 093e41d4c88676a11f8bb195d4023c05cfe3873cdf19a0a0726a6e0fbc43f854
Instruction ID: 672ed0a978cc8b4636a80e0953a2419bbe3d272f8beeba0f46d87504d22d11ae
Opcode Fuzzy Hash: 093e41d4c88676a11f8bb195d4023c05cfe3873cdf19a0a0726a6e0fbc43f854
Instruction Fuzzy Hash: F0912475D40219EFCB10CFA9C984AEFBBB8FF89320F248159E515B7251D374AA52CB60

Function 00AB3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AB396B
CharUpperBuffW.USER32(?,?), ref: 00AB3A7A
_wcslen.LIBCMT ref: 00AB3A8A
VariantClear.OLEAUT32(?), ref: 00AB3C1F

Part of subcall function 00AA0CDF: VariantInit.OLEAUT32(00000000), ref: 00AA0D1F
Part of subcall function 00AA0CDF: VariantCopy.OLEAUT32(?,?), ref: 00AA0D28
Part of subcall function 00AA0CDF: VariantClear.OLEAUT32(?), ref: 00AA0D34

Strings

Incorrect Parameter format, xrefs: 00AB39A6, 00AB3BA1
AUTOIT.ERROR, xrefs: 00AB3A80, 00AB3A85

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: d0233cef04d9777eb4bed531375b2cbd23874b5ce2fe89c540d79757291a5b01
Instruction ID: 63696e8566ddd4afa0ac648712da2962143ec194800563739da508b442dcb177
Opcode Fuzzy Hash: d0233cef04d9777eb4bed531375b2cbd23874b5ce2fe89c540d79757291a5b01
Instruction Fuzzy Hash: AF918C756083059FCB04DF68C58096AB7E8FF89314F14892DF88A9B352DB31EE45CB92

Function 00AB4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00A9000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?,?,00A9035E), ref: 00A9002B
Part of subcall function 00A9000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?), ref: 00A90046
Part of subcall function 00A9000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?), ref: 00A90054
Part of subcall function 00A9000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?), ref: 00A90064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00AB4C51
_wcslen.LIBCMT ref: 00AB4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00AB4DCF
CoTaskMemFree.OLE32(?), ref: 00AB4DDA

Strings

NULL Pointer assignment, xrefs: 00AB4E23, 00AB4E52

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 0667d41f83f60b7a591ab037dd6eb51eb1590b7261dd1336fea7d4cfe7e687bf
Instruction ID: 85aae337827b3871f8a036e7faf267f5edf9f191361499f2024968844c29fac8
Opcode Fuzzy Hash: 0667d41f83f60b7a591ab037dd6eb51eb1590b7261dd1336fea7d4cfe7e687bf
Instruction Fuzzy Hash: 2D91F771D00219AFDF14DFA4C891EEEB7B9BF08310F108169F919A7252DB749A45CFA0

Function 00AC20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00AC2183
GetMenuItemCount.USER32(00000000), ref: 00AC21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00AC21DD
_wcslen.LIBCMT ref: 00AC2213
GetMenuItemID.USER32(?,?), ref: 00AC224D
GetSubMenu.USER32(?,?), ref: 00AC225B

Part of subcall function 00A93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A93A57
Part of subcall function 00A93A3D: GetCurrentThreadId.KERNEL32 ref: 00A93A5E
Part of subcall function 00A93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A925B3), ref: 00A93A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00AC22E3

Part of subcall function 00A9E97B: Sleep.KERNELBASE ref: 00A9E9F3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 1d5744c7aad971f6d8dc7d5894a0458f0b4c67307f0735525dc263284a49e0cc
Instruction ID: d9a4176c6d2fb2bc3de62a868ac0b7104d6e452d91b57b51104de7b0731149ad
Opcode Fuzzy Hash: 1d5744c7aad971f6d8dc7d5894a0458f0b4c67307f0735525dc263284a49e0cc
Instruction Fuzzy Hash: 18716D75A00205AFCB14EFA8C945FAEB7F5EF88320F168459E816EB351DB34ED418B90

Function 00AC7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01595140), ref: 00AC7F37
IsWindowEnabled.USER32(01595140), ref: 00AC7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00AC801E
SendMessageW.USER32(01595140,000000B0,?,?), ref: 00AC8051
IsDlgButtonChecked.USER32(?,?), ref: 00AC8089
GetWindowLongW.USER32(01595140,000000EC), ref: 00AC80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00AC80C3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 828eb62077c596dc9e07a43662cf1d95f0a0a7ec516eda1659aae6de4961d949
Instruction ID: 803af6f568a3d509c382c952331996ef745e87a2afbf49e70c6db30637d2e34f
Opcode Fuzzy Hash: 828eb62077c596dc9e07a43662cf1d95f0a0a7ec516eda1659aae6de4961d949
Instruction Fuzzy Hash: 3571A634608204AFEB219F64C8D4FAEBBB9FF09340F16045DE995972A1CB31A845DFA0

Function 00A9AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A9AEF9
GetKeyboardState.USER32(?), ref: 00A9AF0E
SetKeyboardState.USER32(?), ref: 00A9AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A9AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A9AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A9AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A9B020

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: eacdcc6213a17428095d195c65bc0259548d87ed14874b123e118aa8a323515f
Instruction ID: afba4d518b01876535e3efe34caa44291fe446b47986888ff66e1904c2d0c446
Opcode Fuzzy Hash: eacdcc6213a17428095d195c65bc0259548d87ed14874b123e118aa8a323515f
Instruction Fuzzy Hash: 2551C3A07147D53DFF3683348D49BBA7EE95B06304F08858AE1D9558C2C7D9ACC4D7A1

Function 00A9ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A9AD19
GetKeyboardState.USER32(?), ref: 00A9AD2E
SetKeyboardState.USER32(?), ref: 00A9AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A9ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A9ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A9AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A9AE38

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 3ea0c7d0c1f468619292f212dd73067d74ce8272314853769c2326894da8a8f6
Instruction ID: 826ac0186019f45f5340a029e6421db83b43f31e8f6cea15b65bc58a4dd9c0b9
Opcode Fuzzy Hash: 3ea0c7d0c1f468619292f212dd73067d74ce8272314853769c2326894da8a8f6
Instruction Fuzzy Hash: 4351D7A1B047E53DFF3783348C55BBA7EE95B56300F08858AE1D9468C2D794EC88D7A2

Function 00A6542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00A73CD6,?,?,?,?,?,?,?,?,00A65BA3,?,?,00A73CD6,?,?), ref: 00A65470
__fassign.LIBCMT ref: 00A654EB
__fassign.LIBCMT ref: 00A65506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00A73CD6,00000005,00000000,00000000), ref: 00A6552C
WriteFile.KERNEL32(?,00A73CD6,00000000,00A65BA3,00000000,?,?,?,?,?,?,?,?,?,00A65BA3,?), ref: 00A6554B
WriteFile.KERNEL32(?,?,00000001,00A65BA3,00000000,?,?,?,?,?,?,?,?,?,00A65BA3,?), ref: 00A65584

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: a55c992013f1052826b42419419d978e909969f9c565c8e4c88db2bf0358977c
Instruction ID: 42b12a9aa66b10e82b42d1185a1b316f4290cc73e2ae3b592becab9b56088cd7
Opcode Fuzzy Hash: a55c992013f1052826b42419419d978e909969f9c565c8e4c88db2bf0358977c
Instruction Fuzzy Hash: 135190B1E00649AFDB10CFA8D849AEEBBF9EF19310F14415AE956E7291D6309A41CB60

Function 00A52D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A52D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00A52D53
_ValidateLocalCookies.LIBCMT ref: 00A52DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00A52E0C
_ValidateLocalCookies.LIBCMT ref: 00A52E61

Strings

csm, xrefs: 00A52DF6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d060bf97953cef3b262830fab9b80acc1949c058a69a67e5345944d12b324209
Instruction ID: 54f52a31fbe537f5b5883ba202e5b6df4a5f65a90794e15f28bc5d1ec4450394
Opcode Fuzzy Hash: d060bf97953cef3b262830fab9b80acc1949c058a69a67e5345944d12b324209
Instruction Fuzzy Hash: C241B435E00209EBCF14DF68C885B9EBBB5BF46366F148155EC15AB392D731AA09CBD0

Function 00AB10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB304E: inet_addr.WSOCK32(?), ref: 00AB307A
Part of subcall function 00AB304E: _wcslen.LIBCMT ref: 00AB309B

socket.WSOCK32(00000002,00000001,00000006), ref: 00AB1112
WSAGetLastError.WSOCK32 ref: 00AB1121
WSAGetLastError.WSOCK32 ref: 00AB11C9
closesocket.WSOCK32(00000000), ref: 00AB11F9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 36b8f573bd1b432ca205701eb2ec0a37c438cd5ce8c8a729b109523d0e51b4d9
Instruction ID: 405d6e2a37828ec1a1e1a2d4cd52b568c71933872e5288afc2228c3eb0fe56a6
Opcode Fuzzy Hash: 36b8f573bd1b432ca205701eb2ec0a37c438cd5ce8c8a729b109523d0e51b4d9
Instruction Fuzzy Hash: D341F431600204AFDB10DF58D894BEABBEDEF45324F548159F9199B292D770AD42CBE0

Function 00A9CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A9DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A9CF22,?), ref: 00A9DDFD

Part of subcall function 00A9DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A9CF22,?), ref: 00A9DE16

lstrcmpiW.KERNEL32(?,?), ref: 00A9CF45
MoveFileW.KERNEL32(?,?), ref: 00A9CF7F
_wcslen.LIBCMT ref: 00A9D005
_wcslen.LIBCMT ref: 00A9D01B
SHFileOperationW.SHELL32(?), ref: 00A9D061

Strings

\*.*, xrefs: 00A9CFF3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 909d16e29261cc07293a8de179597684c7578389b213566026165d46d187ef0b
Instruction ID: 86ed0d40147a92cb7b091e435c3ac6d15e7d8aaee3e6685af57e745be8e85f82
Opcode Fuzzy Hash: 909d16e29261cc07293a8de179597684c7578389b213566026165d46d187ef0b
Instruction Fuzzy Hash: 65415C719452185FDF12EFA4DA81EDEB7F9AF08790F1000E6E505EB142EB34A789CB50

Function 00AC2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00AC2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00AC2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00AC2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00AC2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00AC2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00AC2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AC2F0B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e41c2688fa42e882445831441c539c34bc227995a8cc76bfc2ec01c1d46fcc52
Instruction ID: 44bac8a3c5cba74d517cc20bfc8342831195534014b164e923a19abbb1b2a7a9
Opcode Fuzzy Hash: e41c2688fa42e882445831441c539c34bc227995a8cc76bfc2ec01c1d46fcc52
Instruction Fuzzy Hash: 62310134644254AFEB21DF5CDD84FA53BE1FB9A720F1601A8F904AF2B2CB71A841DB41

Function 00A97726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A97769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A9778F
SysAllocString.OLEAUT32(00000000), ref: 00A97792
SysAllocString.OLEAUT32(?), ref: 00A977B0
SysFreeString.OLEAUT32(?), ref: 00A977B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00A977DE
SysAllocString.OLEAUT32(?), ref: 00A977EC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5df0b82eba6177a776fa6d039968ef0d681790c2e779975da32559c96b67899b
Instruction ID: 53610b5026779b9a0744b282acab6d9a608323354141985bc37ff82050701ac9
Opcode Fuzzy Hash: 5df0b82eba6177a776fa6d039968ef0d681790c2e779975da32559c96b67899b
Instruction Fuzzy Hash: D5216B7A614219AFDF10DFE9CD88CBF77ECAB09764B058025FA19DB260D6709C428770

Function 00A977FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A97842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A97868
SysAllocString.OLEAUT32(00000000), ref: 00A9786B
SysAllocString.OLEAUT32 ref: 00A9788C
SysFreeString.OLEAUT32 ref: 00A97895
StringFromGUID2.OLE32(?,?,00000028), ref: 00A978AF
SysAllocString.OLEAUT32(?), ref: 00A978BD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 71bb4a19703ef97857ae47b36f5e77dae40b128532d093ac12be5c88c713e5b5
Instruction ID: 2f15bf3a98a13d264f3ed6032704fdd7c0435716d6188006a0200251ad202894
Opcode Fuzzy Hash: 71bb4a19703ef97857ae47b36f5e77dae40b128532d093ac12be5c88c713e5b5
Instruction Fuzzy Hash: B5214C36618204AFDF109BA8DC8DDAA77E8EB09760715C125F915CB2A1DA64DC82CB74

Function 00AA04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00AA04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AA052E

Strings

nul, xrefs: 00AA0567

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c7ed00a9e6456418ec3c88eca407fb0272f449671561a4425b6a3e863e3f1fa5
Instruction ID: e00e7a96ad87d897f9676ca6451d55d4ef495d533138e1b0a6458d4cbc6f99ce
Opcode Fuzzy Hash: c7ed00a9e6456418ec3c88eca407fb0272f449671561a4425b6a3e863e3f1fa5
Instruction Fuzzy Hash: C021AB74900306AFCF209F69DC04E9A7BB4BF46760F208A18F8A1D72E0E7719940CF20

Function 00AA05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00AA05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AA0601

Strings

nul, xrefs: 00AA0639

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a2f0020f6bd7af8ea9ad282ab0028d68b0c10a3e0cc03eec940190792b4a85b9
Instruction ID: 56a2b994c1417572f70e6c5cc13941ea2cf2597138978f7c4518e4ccf88ad3eb
Opcode Fuzzy Hash: a2f0020f6bd7af8ea9ad282ab0028d68b0c10a3e0cc03eec940190792b4a85b9
Instruction Fuzzy Hash: 402151755003059BDB209F69DC04E9ABBF4BF96734F204A19F9A1E72E0E7B09961CB20

Function 00AC40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A3604C
Part of subcall function 00A3600E: GetStockObject.GDI32(00000011), ref: 00A36060
Part of subcall function 00A3600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A3606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00AC4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00AC411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00AC412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00AC4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00AC4145

Strings

Msctls_Progress32, xrefs: 00AC40E3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 8d367919d8adc08686e03690949543dcec6b0450003064b5f88ef55559b51579
Instruction ID: 9ead98862af9fb388de814e43350642a506392ead501a49bd389b232f73b9917
Opcode Fuzzy Hash: 8d367919d8adc08686e03690949543dcec6b0450003064b5f88ef55559b51579
Instruction Fuzzy Hash: D01193B11402197EEF118F64CC85EE77F9DEF08798F018111FA18A2050C6769C219BA4

Function 00A6D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A6D7A3: _free.LIBCMT ref: 00A6D7CC

_free.LIBCMT ref: 00A6D82D

Part of subcall function 00A629C8: HeapFree.KERNEL32(00000000,00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000), ref: 00A629DE
Part of subcall function 00A629C8: GetLastError.KERNEL32(00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000,00000000), ref: 00A629F0

_free.LIBCMT ref: 00A6D838
_free.LIBCMT ref: 00A6D843
_free.LIBCMT ref: 00A6D897
_free.LIBCMT ref: 00A6D8A2
_free.LIBCMT ref: 00A6D8AD
_free.LIBCMT ref: 00A6D8B8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 460f6728d6410ae031f8b45db90be890dbebb3b1cdcb29d6489c1345cac030d2
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 16113372B40B04BAD521BFF0CD47FCB7BFCAF84780F444825B299AA492DA75B5054751

Function 00A9DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A9DA74
LoadStringW.USER32(00000000), ref: 00A9DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A9DA91
LoadStringW.USER32(00000000), ref: 00A9DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A9DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A9DAB9

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 6264d93619cf6443ebd17b1ed7e092ab02e79e8580d5f5739abf8c675ea78345
Instruction ID: 3ebec059dfddba25a7689c5c46184a40c1513c1505e09d101c1b201912d1c4cd
Opcode Fuzzy Hash: 6264d93619cf6443ebd17b1ed7e092ab02e79e8580d5f5739abf8c675ea78345
Instruction Fuzzy Hash: 4B0162F25002087FEB10EBE49D89EE7326CE708311F400595F74AE2041EA749E854F74

Function 00AA096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0158DFB8,0158DFB8), ref: 00AA097B
EnterCriticalSection.KERNEL32(0158DF98,00000000), ref: 00AA098D
TerminateThread.KERNEL32(?,000001F6), ref: 00AA099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00AA09A9
CloseHandle.KERNEL32(?), ref: 00AA09B8
InterlockedExchange.KERNEL32(0158DFB8,000001F6), ref: 00AA09C8
LeaveCriticalSection.KERNEL32(0158DF98), ref: 00AA09CF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 81400910e67ee8ef73bb9478390c569e701c1563cf07a73c766da5af0ef31c3e
Instruction ID: aeb2eba6c7e7b7b0aa2595d2246d73d25ab0c5f2ae8c6760eb0aa59c0572a8e1
Opcode Fuzzy Hash: 81400910e67ee8ef73bb9478390c569e701c1563cf07a73c766da5af0ef31c3e
Instruction Fuzzy Hash: 94F01972442A12EBD741ABA4EE88ED6BB29FF01712F412026F206918A0C7749466CF90

Function 00A35D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00A35D30
GetWindowRect.USER32(?,?), ref: 00A35D71
ScreenToClient.USER32(?,?), ref: 00A35D99
GetClientRect.USER32(?,?), ref: 00A35ED7
GetWindowRect.USER32(?,?), ref: 00A35EF8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 3c190329860aed62669ff47eff18042ef641d8b9de652d995792d92117748fa8
Instruction ID: 1fa3f9f259376b5e6f79baac902ed74b575e02c9a2bf5c9c09f7af2d550a169b
Opcode Fuzzy Hash: 3c190329860aed62669ff47eff18042ef641d8b9de652d995792d92117748fa8
Instruction Fuzzy Hash: EAB15735A00A4ADBDB14CFB9C8807EAB7F1FF58310F24D41AE8A9D7250DB34AA51DB54

Function 00A601B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A600BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A600D6
__allrem.LIBCMT ref: 00A600ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A6010B
__allrem.LIBCMT ref: 00A60122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A60140

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: b439b86183ab481539a938bc0c50e7f62f10495d472cecdca9125a329fedadcd
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: A281D472A00706AFE7249F68CD41F6B73F9EF41724F24463AF951DA681E770D9848B90

Function 00AB1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB3149: select.WSOCK32(00000000,?,00000000,00000000,?), ref: 00AB3195

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00AB1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00AB1DE1
WSAGetLastError.WSOCK32 ref: 00AB1DF2
inet_ntoa.WSOCK32(?), ref: 00AB1E8C
htons.WSOCK32(?), ref: 00AB1EDB
_strlen.LIBCMT ref: 00AB1F35

Part of subcall function 00A939E8: _strlen.LIBCMT ref: 00A939F2

Part of subcall function 00A36D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00A4CF58,?,?,?), ref: 00A36DBA
Part of subcall function 00A36D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00A4CF58,?,?,?), ref: 00A36DED

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 288a100e52237824d06f0501fc2e34f7790df7acf71eee71861c6503006be47c
Instruction ID: 014f1c121a3c6248c6759746f77223bc817e476e6c99962d18293dc5c4b5725f
Opcode Fuzzy Hash: 288a100e52237824d06f0501fc2e34f7790df7acf71eee71861c6503006be47c
Instruction Fuzzy Hash: 9FA1CF31604340AFC724DF24C8A5FAA7BE9AF84318F94894CF5565B2A3DB31ED46CB91

Function 00A661FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A582D9,00A582D9,?,?,?,00A6644F,00000001,00000001,8BE85006), ref: 00A66258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A6644F,00000001,00000001,8BE85006,?,?,?), ref: 00A662DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A663D8
__freea.LIBCMT ref: 00A663E5

Part of subcall function 00A63820: RtlAllocateHeap.NTDLL(00000000,?,00B01444,?,00A4FDF5,?,?,00A3A976,00000010,00B01440,00A313FC,?,00A313C6,?,00A31129), ref: 00A63852

__freea.LIBCMT ref: 00A663EE
__freea.LIBCMT ref: 00A66413

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: efddfc11d0eba9a2cd88325f5460bdcee2310521588b27eb421bcf20cd5d5e15
Instruction ID: ce513fb1db27f8769051a68146c7d6cf67003ab59c16200ff4f152e055f7d0fc
Opcode Fuzzy Hash: efddfc11d0eba9a2cd88325f5460bdcee2310521588b27eb421bcf20cd5d5e15
Instruction Fuzzy Hash: D051A072A00216ABEB258F64DD81EAF7BB9EF45750F154629FD05DB240EB34DC41C6A0

Function 00ABBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00ABC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ABB6AE,?,?), ref: 00ABC9B5
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABC9F1
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA68
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ABBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00ABBD25
RegCloseKey.ADVAPI32(00000000), ref: 00ABBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00ABBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00ABBDF3
RegCloseKey.ADVAPI32(?), ref: 00ABBDFF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: f28a1fe3fbacee25a7a1de421bf56540c04d154eee15da0bf1b0130e88f94131
Instruction ID: c1488c330a5eef1ba3e720700a62ee3445ef59cc93fa191ce2ed0dce4d21fc92
Opcode Fuzzy Hash: f28a1fe3fbacee25a7a1de421bf56540c04d154eee15da0bf1b0130e88f94131
Instruction Fuzzy Hash: 8581A030218241EFD714DF24C991E6ABBE9FF84318F14895CF4994B2A2DB71ED45CBA2

Function 00A8F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00A8F7B9
SysAllocString.OLEAUT32(00000001), ref: 00A8F860
VariantCopy.OLEAUT32(00A8FA64,00000000), ref: 00A8F889
VariantClear.OLEAUT32(00A8FA64), ref: 00A8F8AD
VariantCopy.OLEAUT32(00A8FA64,00000000), ref: 00A8F8B1
VariantClear.OLEAUT32(?), ref: 00A8F8BB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 25573c1c039b98baec5b918cfeeaff91670197390f143d319809d8842195b920
Instruction ID: 1aa0dba034282e2a274ef8802c0811e8f0a373297a378f0198809bdf7044cd9a
Opcode Fuzzy Hash: 25573c1c039b98baec5b918cfeeaff91670197390f143d319809d8842195b920
Instruction Fuzzy Hash: E451B335A00312BECF24BF65D995B29B3A9EF45310F249467F906DF292DB708C40CBA6

Function 00AA910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00A37620: _wcslen.LIBCMT ref: 00A37625

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00AA94E5
_wcslen.LIBCMT ref: 00AA9506
_wcslen.LIBCMT ref: 00AA952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00AA9585

Strings

X, xrefs: 00AA9412

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: d4a942e8bba0ae51ac65bddf541aba6ec40ad6622cf0800a8a01fc307cccd989
Instruction ID: 39259b731e92a1fe73c1a974a71d75e6e43d4cb7fde5ac96a4757b0f254034a4
Opcode Fuzzy Hash: d4a942e8bba0ae51ac65bddf541aba6ec40ad6622cf0800a8a01fc307cccd989
Instruction Fuzzy Hash: DAE19F319083019FDB24DF24C981B6BB7E4BF85314F04896DF89A9B2A2DB31DD05CB92

Function 00A4920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

BeginPaint.USER32(?,?,?), ref: 00A49241
GetWindowRect.USER32(?,?), ref: 00A492A5
ScreenToClient.USER32(?,?), ref: 00A492C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00A492D3
EndPaint.USER32(?,?,?,?,?), ref: 00A49321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00A871EA

Part of subcall function 00A49339: BeginPath.GDI32(00000000), ref: 00A49357

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 0e5263c22e970f3087d54832d5949a8f60815e220dcde07d2269b2228964be4c
Instruction ID: 16fc395deb905993844201f02e1a574b107c8622712cee21b2472815f6c63904
Opcode Fuzzy Hash: 0e5263c22e970f3087d54832d5949a8f60815e220dcde07d2269b2228964be4c
Instruction Fuzzy Hash: 23419D34104200AFD721DF68CC88FAB7BB8EB96720F140669F9948B2B1CB719856DB61

Function 00AA07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00AA080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00AA0847
EnterCriticalSection.KERNEL32(?), ref: 00AA0863
LeaveCriticalSection.KERNEL32(?), ref: 00AA08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00AA08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00AA0921

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 68d1cf85a0a3f3204d5a133ca9cdacce1ba333eee0814f9dea83fb3739ee342d
Instruction ID: 0221a169724fd1c0a005dbbc6856bca0aed0f71c264bbcfe47b36a736edcaaee
Opcode Fuzzy Hash: 68d1cf85a0a3f3204d5a133ca9cdacce1ba333eee0814f9dea83fb3739ee342d
Instruction Fuzzy Hash: 6A419871900205EFDF04EF94DC85AAAB7B8FF44310F1440A9ED049B296DB34DE66CBA4

Function 00AC81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00A8F3AB,00000000,?,?,00000000,?,00A8682C,00000004,00000000,00000000), ref: 00AC824C
EnableWindow.USER32(?,00000000), ref: 00AC8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00AC82D1
ShowWindow.USER32(?,00000004), ref: 00AC82E5
EnableWindow.USER32(?,00000001), ref: 00AC830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00AC832F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 23451c88d9354cb19cfaf61cf0ae50862dac62463e8cfb806cd6c1040af7083a
Instruction ID: 89641f3896d4a260605bc57fcd64370c0f829785740e555ca01c4681eda0257a
Opcode Fuzzy Hash: 23451c88d9354cb19cfaf61cf0ae50862dac62463e8cfb806cd6c1040af7083a
Instruction Fuzzy Hash: D841B374601644EFDB25CF19C899FE47BE0FB4A714F1A52ADE5184F2B2CB35A842CB50

Function 00A94C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A94C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A94CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A94CEA
_wcslen.LIBCMT ref: 00A94D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A94D10
_wcsstr.LIBVCRUNTIME ref: 00A94D1A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: f1aecc811aecaf1ed2add9acc286187fe63e289f5f0aba4fdea819d8f0964f06
Instruction ID: 895e5ca9a9bc49597561ad800024bcffcb62acc30334672ec4197efac0725df8
Opcode Fuzzy Hash: f1aecc811aecaf1ed2add9acc286187fe63e289f5f0aba4fdea819d8f0964f06
Instruction Fuzzy Hash: F221F676704200BFEF159B79AD4AE7B7BECDF49760F108029F809CA191EA65DC4297A0

Function 00AA581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A33A97,?,?,00A32E7F,?,?,?,00000000), ref: 00A33AC2

_wcslen.LIBCMT ref: 00AA587B
CoInitialize.OLE32(00000000), ref: 00AA5995
CoCreateInstance.OLE32(00ACFCF8,00000000,00000001,00ACFB68,?), ref: 00AA59AE
CoUninitialize.OLE32 ref: 00AA59CC

Strings

.lnk, xrefs: 00AA5876, 00AA58C1, 00AA5985

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: ee053985d91b4e092f832c78d0946a1e1de5f799632e6a57ff0079344f968f59
Instruction ID: 2970282a27cf82a8147139ce6d60695e86e01dcf30a4463d0b40fb847935f403
Opcode Fuzzy Hash: ee053985d91b4e092f832c78d0946a1e1de5f799632e6a57ff0079344f968f59
Instruction Fuzzy Hash: 3ED15475A087019FC714DF25C584A2ABBE1FF8A720F14885DF88A9B3A1D731EC45CB92

Function 00A9175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A90FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A90FCA
Part of subcall function 00A90FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A90FD6
Part of subcall function 00A90FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A90FE5
Part of subcall function 00A90FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A90FEC
Part of subcall function 00A90FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A91002

GetLengthSid.ADVAPI32(?,00000000,00A91335), ref: 00A917AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A917BA
HeapAlloc.KERNEL32(00000000), ref: 00A917C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A917DA
GetProcessHeap.KERNEL32(00000000,00000000,00A91335), ref: 00A917EE
HeapFree.KERNEL32(00000000), ref: 00A917F5

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: cf15c5c50d9c6fe143e6f290b708ca8d8756e6f2ef75f8cdc66da6955c1f0961
Instruction ID: 718374c0641629893f9f36cecb9f18077d49898525ad59bb32b8fef0cbdc7051
Opcode Fuzzy Hash: cf15c5c50d9c6fe143e6f290b708ca8d8756e6f2ef75f8cdc66da6955c1f0961
Instruction Fuzzy Hash: 43115632A00606EFDF10DBE5CC49FAE7BE9EB45365F154118E486A7220D736A945CB60

Function 00A914CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A914FF
OpenProcessToken.ADVAPI32(00000000), ref: 00A91506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A91515
CloseHandle.KERNEL32(00000004), ref: 00A91520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A9154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A91563

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 670677d5fa13959a8dac34758e32c97cac61fceca64f11c7045ba1f58a2ab154
Instruction ID: 23f099fa3305a0e4c96ab0d5b2172a797278da7a4a38692e5ebb840bdc3650b4
Opcode Fuzzy Hash: 670677d5fa13959a8dac34758e32c97cac61fceca64f11c7045ba1f58a2ab154
Instruction Fuzzy Hash: 801117B660024AABDF11CF98ED49FDA7BA9FB48754F064015FA09A2160C3758E619B60

Function 00A53382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A53379,00A52FE5), ref: 00A53390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A5339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A533B7
SetLastError.KERNEL32(00000000,?,00A53379,00A52FE5), ref: 00A53409

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 48d6406f96e86a1e7afe8726039a37f8e6477a9649d71bcc97248bccb3cc9c16
Instruction ID: ccf13e8eb458c5bb90976c83f12ff1732835f9338f7a9427fadd97cc3f4b1474
Opcode Fuzzy Hash: 48d6406f96e86a1e7afe8726039a37f8e6477a9649d71bcc97248bccb3cc9c16
Instruction Fuzzy Hash: D4019233609715AAEE1567F57E859672A64FB853BB720022DFC10892F1EE314D0B9548

Function 00A62D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A65686,00A73CD6,?,00000000,?,00A65B6A,?,?,?,?,?,00A5E6D1,?,00AF8A48), ref: 00A62D78
_free.LIBCMT ref: 00A62DAB
_free.LIBCMT ref: 00A62DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00A5E6D1,?,00AF8A48,00000010,00A34F4A,?,?,00000000,00A73CD6), ref: 00A62DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00A5E6D1,?,00AF8A48,00000010,00A34F4A,?,?,00000000,00A73CD6), ref: 00A62DEC
_abort.LIBCMT ref: 00A62DF2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 476d0b9ea6b63e33056b3db80cce95a323c29b4b1e410e4ed3cf11247cffded6
Instruction ID: 2c6d5732e069cb13990b4b8c296ce7a9b62be48a605eb77647d454efec07a3f1
Opcode Fuzzy Hash: 476d0b9ea6b63e33056b3db80cce95a323c29b4b1e410e4ed3cf11247cffded6
Instruction Fuzzy Hash: 7DF0C832A44E01A7D61277B9BE16F6E2579AFC27B1F250518F828972D2EF2488034360

Function 00AC8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00A49639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A49693
Part of subcall function 00A49639: SelectObject.GDI32(?,00000000), ref: 00A496A2
Part of subcall function 00A49639: BeginPath.GDI32(?), ref: 00A496B9
Part of subcall function 00A49639: SelectObject.GDI32(?,00000000), ref: 00A496E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00AC8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00AC8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00AC8A70
LineTo.GDI32(?,00000000,00000003), ref: 00AC8A80
EndPath.GDI32(?), ref: 00AC8A90
StrokePath.GDI32(?), ref: 00AC8AA0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 672a82e8e918d05a848d10bed10fa49db2e23e00b5c83df18e7d3d631c22d51f
Instruction ID: 779d593ec0395d0a31b192eec0048a6cbffa6fd1de9c5a844dfafe9cc374b508
Opcode Fuzzy Hash: 672a82e8e918d05a848d10bed10fa49db2e23e00b5c83df18e7d3d631c22d51f
Instruction Fuzzy Hash: 41110976400108FFDB129F94EC88EAA7F6CEB083A0F058016FA599A1A1C7719D56DFA0

Function 00A951FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A95218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A95229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A95230
ReleaseDC.USER32(00000000,00000000), ref: 00A95238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A9524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00A95261

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 96acf4b8e59f6515a8a8d5156017c3fda1fa77618a3d4a129975c5ea5568e7c5
Instruction ID: c7c62a8eadd596e2ee1744dcd76dd895886d25f991e7e9c5a96189cee3166b16
Opcode Fuzzy Hash: 96acf4b8e59f6515a8a8d5156017c3fda1fa77618a3d4a129975c5ea5568e7c5
Instruction Fuzzy Hash: F2018475E01704BBEF109BF59D49E4EBFB8EF44361F044065FA08AB280D6709C01CB60

Function 00A31BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00A31BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00A31BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00A31C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00A31C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00A31C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A31C22

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: eb122ef2283404c6360c62068cdd4ac4557995ea68408d55bda7fdd47d6f13dd
Instruction ID: 76be41e147b9fc295e59f1d0bfaf1d2f6da812e47fb623b72890bc4bcffafeba
Opcode Fuzzy Hash: eb122ef2283404c6360c62068cdd4ac4557995ea68408d55bda7fdd47d6f13dd
Instruction Fuzzy Hash: 980167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BE15C4BA42C7F5A864CBE5

Function 00A9EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A9EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A9EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00A9EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A9EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A9EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A9EB75

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 03acd30e6a149520be528514770a90e3e4b84e1e1a5e6d7e419c15833a886903
Instruction ID: 9a778d462f03ad28f4316ca3bed1fdf6857bcd83737fa1537361a4a6c2f1e820
Opcode Fuzzy Hash: 03acd30e6a149520be528514770a90e3e4b84e1e1a5e6d7e419c15833a886903
Instruction Fuzzy Hash: 62F0BE72600158BBE7209BA39C0EEEF3E7CEFCAB25F010158F605D1091D7A01A02C6B4

Function 00A87439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00A87452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00A87469
GetWindowDC.USER32(?), ref: 00A87475
GetPixel.GDI32(00000000,?,?), ref: 00A87484
ReleaseDC.USER32(?,00000000), ref: 00A87496
GetSysColor.USER32(00000005), ref: 00A874B0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: fb5ebd68847a7f1539f0b4c4667050977e3b9db46480c356e7cd46402b22b55b
Instruction ID: efe6c27528009b23af6a6228e7b0f980c4a3be7db6c4b3ab26559f1f3cac3efa
Opcode Fuzzy Hash: fb5ebd68847a7f1539f0b4c4667050977e3b9db46480c356e7cd46402b22b55b
Instruction Fuzzy Hash: FD014B31400215EFDB51AFA4DD08FAE7BB5FB04321F660164F91AA21A1CF311E52AB50

Function 00A91874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A9187F
UnloadUserProfile.USERENV(?,?), ref: 00A9188B
CloseHandle.KERNEL32(?), ref: 00A91894
CloseHandle.KERNEL32(?), ref: 00A9189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A918A5
HeapFree.KERNEL32(00000000), ref: 00A918AC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: bded03fc369bedd28d50395dae2fbab03fae0a9fa8370db3981ea95589f21e2f
Instruction ID: 61b90f4b0f955f73267e7ed48a522904e58a18b0b13ef6f34d9f69dea9a898ba
Opcode Fuzzy Hash: bded03fc369bedd28d50395dae2fbab03fae0a9fa8370db3981ea95589f21e2f
Instruction Fuzzy Hash: 1BE0C23A404501BBDB019BE2ED0CD0ABB29FB49B32B128220F22985570CB329422DB50

Function 00A9C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A37620: _wcslen.LIBCMT ref: 00A37625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A9C6EE
_wcslen.LIBCMT ref: 00A9C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A9C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A9C7CA

Strings

0, xrefs: 00A9C6AF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: ece840788989c59c515502a178bba2174b3cb5a659a9088d4b78faebb2ff402e
Instruction ID: f8f82f5a05246df5f5bf7b9d41ff9bada574ad6a34205203839040a6b57e0c92
Opcode Fuzzy Hash: ece840788989c59c515502a178bba2174b3cb5a659a9088d4b78faebb2ff402e
Instruction Fuzzy Hash: 7151CB717047409BDB14DFA8C985B6BBBE8AF89324F041A2DF995E71E0DB70D904CB92

Function 00ABAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00ABAEA3

Part of subcall function 00A37620: _wcslen.LIBCMT ref: 00A37625

GetProcessId.KERNEL32(00000000), ref: 00ABAF38
CloseHandle.KERNEL32(00000000), ref: 00ABAF67

Strings

<, xrefs: 00ABAE6B
@, xrefs: 00ABAE72

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: f351493345ad037fc81028f930cb06b3c3ba17c3b6ee1490e8ae56ee090ad13c
Instruction ID: 66546a692a6f4eb5fa4035040e796b70ddc9c1996b52700252e9b3d2fc30121d
Opcode Fuzzy Hash: f351493345ad037fc81028f930cb06b3c3ba17c3b6ee1490e8ae56ee090ad13c
Instruction Fuzzy Hash: EC717675A00618DFCB14DFA4C584A9EBBF4FF08310F048499E85AAB3A2CB74ED41CB91

Function 00A9719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A97206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A9723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A9724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A972CF

Strings

DllGetClassObject, xrefs: 00A97242

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 785f42a1c37eb56071b57aa3a99d6825b111d08007c82469b1599dde631b85df
Instruction ID: 87f882b685e4685f23bc243f0c40a7861b2dedee4db60d174ddd586476f21a0e
Opcode Fuzzy Hash: 785f42a1c37eb56071b57aa3a99d6825b111d08007c82469b1599dde631b85df
Instruction Fuzzy Hash: D3413B71A24204AFDF15CF94C884A9E7BE9EF84710F2580A9BD099F20AD7B1D945CBB0

Function 00AC3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AC3E35
IsMenu.USER32(?), ref: 00AC3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00AC3E92
DrawMenuBar.USER32 ref: 00AC3EA5

Strings

0, xrefs: 00AC3D89

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 1c6c3591bad08d0d006b16be741284f4b61405a65fac929d99b9d07442da5b28
Instruction ID: 92afb2be67fffdb39bfcecaf8c900f336a7bed4910b5fe5d3c5d589440ea55ba
Opcode Fuzzy Hash: 1c6c3591bad08d0d006b16be741284f4b61405a65fac929d99b9d07442da5b28
Instruction Fuzzy Hash: 6F411876A01209AFDF10DF94D884EAABBF5FF49364F05812DE905A7250D730AE45CB60

Function 00A91DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A91E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A91E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A91EA9

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

Strings

ListBox, xrefs: 00A91E25
ComboBox, xrefs: 00A91DF0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 5abaeb9d29f00207595f23c168d12e8063dfd6f929d98d1ba18785f52ed85286
Instruction ID: abe5ea43a4499476dd5000154992286556485d07fce75689e2341702ea477059
Opcode Fuzzy Hash: 5abaeb9d29f00207595f23c168d12e8063dfd6f929d98d1ba18785f52ed85286
Instruction Fuzzy Hash: 6A21F175A00108BFDF14ABA4DE4ACFFB7F8EF45360F104519F925A71E1DB78490A8A20

Function 00ABC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ABC9F1
_wcslen.LIBCMT ref: 00ABCA68
_wcslen.LIBCMT ref: 00ABCA9E
_wcslen.LIBCMT ref: 00ABCAF9
_wcslen.LIBCMT ref: 00ABCB2F
_wcslen.LIBCMT ref: 00ABCB7F

Strings

HKLM, xrefs: 00ABCA98, 00ABCA9D
HKEY_LOCAL_MACHINE, xrefs: 00ABCA62, 00ABCA67

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: f1f02da4b4584ad5611a83b80ec5cfb8190c18d9fad1e03711163e27eae71be6
Instruction ID: b3e2151fcd81d9dfb242eb5133c58b38f3669c01d0bfa100173d473f778874e1
Opcode Fuzzy Hash: f1f02da4b4584ad5611a83b80ec5cfb8190c18d9fad1e03711163e27eae71be6
Instruction Fuzzy Hash: 0B31A77360016A8ACB20DF6C99419FF379B5BA17E4F15401DFC55AB246EA71CD8493A0

Function 00AC2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00AC2F8D
LoadLibraryW.KERNEL32(?), ref: 00AC2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00AC2FA9
DestroyWindow.USER32(?), ref: 00AC2FB1

Strings

SysAnimate32, xrefs: 00AC2F68

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 912722e4a86a6dd2b34872293819eb7964cf48700e3849cd91b1d851094b2276
Instruction ID: 0dba8262b8ad499f1cff7c8afcd19067e74bb1a162cdf7581be8db340e00790e
Opcode Fuzzy Hash: 912722e4a86a6dd2b34872293819eb7964cf48700e3849cd91b1d851094b2276
Instruction Fuzzy Hash: AE21CD71200209ABEF218FA4DC80FBB77BDEB59364F12561CFA50D6190DB71DC6197A0

Function 00A54D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A54D1E,00A628E9,?,00A54CBE,00A628E9,00AF88B8,0000000C,00A54E15,00A628E9,00000002), ref: 00A54D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A54DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00A54D1E,00A628E9,?,00A54CBE,00A628E9,00AF88B8,0000000C,00A54E15,00A628E9,00000002,00000000), ref: 00A54DC3

Strings

mscoree.dll, xrefs: 00A54D86
CorExitProcess, xrefs: 00A54D98

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1c722b1989755280ab58dc7e23c8cdc183a64b213db36a318e164d09c8d0bf1
Instruction ID: 4ce248ada902170b640ec7ae2c5ed18066875d71617de39cb5040105c99500bf
Opcode Fuzzy Hash: f1c722b1989755280ab58dc7e23c8cdc183a64b213db36a318e164d09c8d0bf1
Instruction Fuzzy Hash: 59F04F35A40208BBEB119FD1DC49FAEBFB5FF48766F0501A5FD0AA6260CB345985CB90

Function 00A34E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A34EDD,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A34EAE
FreeLibrary.KERNEL32(00000000,?,?,00A34EDD,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00A34EA8
kernel32.dll, xrefs: 00A34E94

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: d736b95037030f4c3d8c075876fcc6f180a9ba5c4a2101eef75662fa6d804c8c
Instruction ID: 4cab6196224e02b86b9e1467d58962e8709fa975e5ffb557116916a36fb0e6aa
Opcode Fuzzy Hash: d736b95037030f4c3d8c075876fcc6f180a9ba5c4a2101eef75662fa6d804c8c
Instruction Fuzzy Hash: 8EE0CD36E055226FD33157666C18FAF6554BFC5F72F1A0215FD08E2110DB64DD0340A0

Function 00A34E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A73CDE,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A34E74
FreeLibrary.KERNEL32(00000000,?,?,00A73CDE,?,00B01418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A34E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00A34E6E
kernel32.dll, xrefs: 00A34E5B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: e103a71ec66532c85dd7aa6746c61d31c555a18a8f4413c38b0f45ce729f9ce9
Instruction ID: 99f64784b8abf688b9e2da61fcad41a4dac437ee3b3948bf220876930cbb3b38
Opcode Fuzzy Hash: e103a71ec66532c85dd7aa6746c61d31c555a18a8f4413c38b0f45ce729f9ce9
Instruction Fuzzy Hash: 21D012369026216BDA225BA6AC18EDB6A18BF89F7171A0615F909A2114CF64DD0385D0

Function 00AA2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AA2C05
DeleteFileW.KERNEL32(?), ref: 00AA2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00AA2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AA2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AA2CC0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 1d3492bdbe544a4261eef391e39717f54ac0189898c4e138af10d7bc76e837af
Instruction ID: 1d9629f00c70b1540246c52d38dea04893e35b13651a731c8975f753496ad196
Opcode Fuzzy Hash: 1d3492bdbe544a4261eef391e39717f54ac0189898c4e138af10d7bc76e837af
Instruction Fuzzy Hash: D5B16D71D00119ABDF25EFA8CD85EDEB7BDEF49350F1040A6FA09E7181EB319A548B60

Function 00ABA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00ABA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00ABA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00ABA468
CloseHandle.KERNEL32(?), ref: 00ABA63D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: d483943fc855f79868768b4ab69a088b80d43cb5846e1cc4d968ac0c39894502
Instruction ID: 72a981571ff6ed04351bd06f39ed8c47971aeed39f0a9e270f5d114321bc4213
Opcode Fuzzy Hash: d483943fc855f79868768b4ab69a088b80d43cb5846e1cc4d968ac0c39894502
Instruction Fuzzy Hash: 75A1A175604300AFD720DF24C986F2AB7E5AF94714F14881DF69A9B392DB70EC41CB92

Function 00A9E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A9DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A9CF22,?), ref: 00A9DDFD

Part of subcall function 00A9DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A9CF22,?), ref: 00A9DE16

Part of subcall function 00A9E199: GetFileAttributesW.KERNEL32(?,00A9CF95), ref: 00A9E19A

lstrcmpiW.KERNEL32(?,?), ref: 00A9E473
MoveFileW.KERNEL32(?,?), ref: 00A9E4AC
_wcslen.LIBCMT ref: 00A9E5EB
_wcslen.LIBCMT ref: 00A9E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00A9E650

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 22e2e386e2aa28e8aaa93b7429454246be75c87bcf554532eb2f6b5029c96eaa
Instruction ID: b1bddb0f08931cd946bd1ffca22bf36811239fb0badc2bc2f04500e6429b61f0
Opcode Fuzzy Hash: 22e2e386e2aa28e8aaa93b7429454246be75c87bcf554532eb2f6b5029c96eaa
Instruction Fuzzy Hash: 3F5163B25083459BCB24EB90DD819DFB3ECAF84350F00491EF689D3192EF75A688C766

Function 00ABB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00ABC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ABB6AE,?,?), ref: 00ABC9B5
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABC9F1
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA68
Part of subcall function 00ABC998: _wcslen.LIBCMT ref: 00ABCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ABBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00ABBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00ABBB63
RegCloseKey.ADVAPI32(?,?), ref: 00ABBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00ABBBB3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 87f376e64fc093ad885fe8ed2f768affcecddf9bca85b89cd0d4cb8c23b0e9c2
Instruction ID: ab5920ae00381872ec5ff120df2baee62d16abc218fa278888bb136a898c20c8
Opcode Fuzzy Hash: 87f376e64fc093ad885fe8ed2f768affcecddf9bca85b89cd0d4cb8c23b0e9c2
Instruction Fuzzy Hash: 6461A031218241EFD714DF14C890E6ABBE9FF84358F14895CF4998B2A2DB71ED45CBA2

Function 00A98BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A98BCD
VariantClear.OLEAUT32 ref: 00A98C3E
VariantClear.OLEAUT32 ref: 00A98C9D
VariantClear.OLEAUT32(?), ref: 00A98D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A98D3B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 4af9ba1c117ae016301a119ec7dfddeaae8b36409bca2daba70c4d023b346c42
Instruction ID: 08e6a251d9d13f97c0ef5c817b4e775d448cf4dfdacea55c0611bd0e32ad57fb
Opcode Fuzzy Hash: 4af9ba1c117ae016301a119ec7dfddeaae8b36409bca2daba70c4d023b346c42
Instruction Fuzzy Hash: 7F5156B5A00219EFCB14CF68C894EAAB7F8FF89310B158559E909DB350E734E912CB90

Function 00AA8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00AA8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00AA8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00AA8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00AA8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00AA8C5F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 47bf7d957b8568d282ecc8c1bb340a36eb3262183e139fcd12e434258c71e6f6
Instruction ID: 50ffe6ef30beaa1539ee11e0b56f9da549ffbd01584e8a2884ac7dc8e11193b1
Opcode Fuzzy Hash: 47bf7d957b8568d282ecc8c1bb340a36eb3262183e139fcd12e434258c71e6f6
Instruction Fuzzy Hash: 36513A75A002189FCB14DF65C981A6DBBF5FF49314F088458E84AAB3A2CB35ED51CF90

Function 00AB8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00AB8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00AB8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00AB8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00AB9032
FreeLibrary.KERNEL32(00000000), ref: 00AB9052

Part of subcall function 00A4F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00AA1043,?,753CE610), ref: 00A4F6E6
Part of subcall function 00A4F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00A8FA64,00000000,00000000,?,?,00AA1043,?,753CE610,?,00A8FA64), ref: 00A4F70D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 7a7452aa316e15b8c5887fcbb943ac88c95b783d08aad2731bcfb914c4cead7d
Instruction ID: 4f62ed1c7eea04880da692cb31d8e548993797d7ee546383e01fad80e64844b7
Opcode Fuzzy Hash: 7a7452aa316e15b8c5887fcbb943ac88c95b783d08aad2731bcfb914c4cead7d
Instruction Fuzzy Hash: 35514C35604205DFCB10EF68C4848ADBBB5FF49324F098098E90A9B362DB31ED86CB91

Function 00AC6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00AC6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00AC6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00AC6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00AAAB79,00000000,00000000), ref: 00AC6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00AC6CC7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 20e982a4c3e09169a9076d78eded46a7ac7903c8fb0bd7ad109a874122fe39dd
Instruction ID: fa1883f47e9b25a92311de3326360299c3fddc105a9099b49a4494d73e4bcf34
Opcode Fuzzy Hash: 20e982a4c3e09169a9076d78eded46a7ac7903c8fb0bd7ad109a874122fe39dd
Instruction Fuzzy Hash: B741C435A08104AFDB24CF68CD58FA97BB5EB09360F16026CF999E72E1C771ED41DA90

Function 00A62051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A620C3
_free.LIBCMT ref: 00A620E3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: aa4243dd16d1a7820a4e23186d88f5c508591f43e03d4c49d445990b57e6f7c6
Instruction ID: 2504ceb1a4bd144f641a1be47e48e8b595fa8c76e9b836bf51954fe07e73d015
Opcode Fuzzy Hash: aa4243dd16d1a7820a4e23186d88f5c508591f43e03d4c49d445990b57e6f7c6
Instruction Fuzzy Hash: 2241E472A006049FCB24DFB8C981B6DB7F5EF89714F164569E915EB391DB31AD01CB80

Function 00A4912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A49141
ScreenToClient.USER32(00000000,?), ref: 00A4915E
GetAsyncKeyState.USER32(00000001), ref: 00A49183
GetAsyncKeyState.USER32(00000002), ref: 00A4919D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: b0c48250561b000f1429cff1aa18a21ec365fdc645680bedaeadfb2c9531eb7f
Instruction ID: 6c90c2c33c8ae93ff73ad09b376f4e6ac914c3d0fb07d47f5bb8a093d5fabdec
Opcode Fuzzy Hash: b0c48250561b000f1429cff1aa18a21ec365fdc645680bedaeadfb2c9531eb7f
Instruction Fuzzy Hash: 9941403590851AFBDF15EF68C848BEEB774FB45320F204319E429A72E0C730A950CB51

Function 00AA3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00AA38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00AA3922
TranslateMessage.USER32(?), ref: 00AA394B
DispatchMessageW.USER32(?), ref: 00AA3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AA3966

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 8893c57e600eac55c478eeb6974a4b86e4533cc950401479d3e28bf20a3178ef
Instruction ID: 79749f0170cf4e76f664c0e960872b051bab1c8fece4f8baa8310dfa2d924f35
Opcode Fuzzy Hash: 8893c57e600eac55c478eeb6974a4b86e4533cc950401479d3e28bf20a3178ef
Instruction Fuzzy Hash: 19318472904345AFEF29CB749868BB737E8EB17304F04496DF466831E0E7B49A85CB11

Function 00AACF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00AACF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00AACF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00AAC21E,00000000), ref: 00AACFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00AAC21E,00000000), ref: 00AACFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00AAC21E,00000000), ref: 00AACFF2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: cbf0ccd78197035dd3b46d62b9435a63e8b39ea55040875c04a84a8da95ff268
Instruction ID: 87be0c86c514e0f23059e6a86411784a0f8f3051f37b6d89c94cffa2679a1018
Opcode Fuzzy Hash: cbf0ccd78197035dd3b46d62b9435a63e8b39ea55040875c04a84a8da95ff268
Instruction Fuzzy Hash: A8314B71904305EFEB20DFA5C984AAEBBF9EB15365B10442EF51AD7181DB30AE41DB60

Function 00A91901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A91915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00A919C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00A919C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00A919DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00A919E2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a4eeceb508c78dc645560cc7ad5a34bda42b7e8633cdb38be6a77fa293afc625
Instruction ID: f4f7b07740925f239eecf88554c3403357c156980b537ba5850d4b04d5d42739
Opcode Fuzzy Hash: a4eeceb508c78dc645560cc7ad5a34bda42b7e8633cdb38be6a77fa293afc625
Instruction Fuzzy Hash: D431C071A0021AEFDF00CFA8CD99ADE3BB5EB04325F104229F925AB2D1C7709D45CB90

Function 00AC5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00AC5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00AC579D
_wcslen.LIBCMT ref: 00AC57AF
_wcslen.LIBCMT ref: 00AC57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00AC5816

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 18c24ad6ecca93a6bc60a70181b06529d1fde5ca8206959115101006f7a3373d
Instruction ID: 354c120857d3f2a003d802d5e451cb946ae5bc17c551c7f76ebd437751dff53b
Opcode Fuzzy Hash: 18c24ad6ecca93a6bc60a70181b06529d1fde5ca8206959115101006f7a3373d
Instruction Fuzzy Hash: 3D218D31D046189ADB208FB4CD85FEE7BB8FF04324F11865AF929AA180D774AAC5CF50

Function 00AB0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00AB0951
GetForegroundWindow.USER32 ref: 00AB0968
GetDC.USER32(00000000), ref: 00AB09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00AB09B0
ReleaseDC.USER32(00000000,00000003), ref: 00AB09E8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 6ff5744200746dc17f3c20c0254ea44276b2344acacccb421da8398c03e217ca
Instruction ID: 0d13cea10d7d829ed54bb71a28c532a34f9284289fefeb9e9efc5800274afe92
Opcode Fuzzy Hash: 6ff5744200746dc17f3c20c0254ea44276b2344acacccb421da8398c03e217ca
Instruction Fuzzy Hash: A5219335600204AFD714EFA9C984EAEBBF9EF49750F058068F85AD7752CB30AC05CB50

Function 00A6CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A6CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A6CDE9

Part of subcall function 00A63820: RtlAllocateHeap.NTDLL(00000000,?,00B01444,?,00A4FDF5,?,?,00A3A976,00000010,00B01440,00A313FC,?,00A313C6,?,00A31129), ref: 00A63852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A6CE0F
_free.LIBCMT ref: 00A6CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A6CE31

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 22fc4b0ee4cbacc9ad60e63a19bd7a56f8827da127df625858122e1543865436
Instruction ID: 93e9f47f67a0b464a24db314b6ffcb66637dbc0540c1a7b72ce3bb1c7d33b8af
Opcode Fuzzy Hash: 22fc4b0ee4cbacc9ad60e63a19bd7a56f8827da127df625858122e1543865436
Instruction Fuzzy Hash: 2101F772A026157FA32157B66C8CD7F797DDEC6FB13150129FD09D7200EA6A8D0281F0

Function 00A49639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A49693
SelectObject.GDI32(?,00000000), ref: 00A496A2
BeginPath.GDI32(?), ref: 00A496B9
SelectObject.GDI32(?,00000000), ref: 00A496E2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 0025b138c3118aba75a8578ad02ae48cfb8a5ba5f1687488cc0aa4a8d86e417a
Instruction ID: bf4ad930928c04c1d75f30f52aff019842eab5d704580113ed7731a6307a5c66
Opcode Fuzzy Hash: 0025b138c3118aba75a8578ad02ae48cfb8a5ba5f1687488cc0aa4a8d86e417a
Instruction Fuzzy Hash: 05218034802305EFDB15DF69EC08BAB7BB8BBA0325F114616F414A71B0D77098A3CBA0

Function 00A95711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A95726
_memcmp.LIBVCRUNTIME ref: 00A95744
_memcmp.LIBVCRUNTIME ref: 00A95757
_memcmp.LIBVCRUNTIME ref: 00A9576F
_memcmp.LIBVCRUNTIME ref: 00A95787

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 141041a7ca9aa1801ed2dafb89b68ba925bb6624c714d07bebf8e142a3bd995d
Instruction ID: 565e70d874c41d3e83829a34513c995427b21f907437c030b935853600d9ebed
Opcode Fuzzy Hash: 141041a7ca9aa1801ed2dafb89b68ba925bb6624c714d07bebf8e142a3bd995d
Instruction Fuzzy Hash: 010196B1B45605BE9A0956609E93FBA639DAB213A5B004825FD04AE241FB70EE1483A1

Function 00A4990E Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00A498CC
SetTextColor.GDI32(?,?), ref: 00A498D6
SetBkMode.GDI32(?,00000001), ref: 00A498E9
GetStockObject.GDI32(00000005), ref: 00A498F1
GetWindowLongW.USER32(?,000000EB), ref: 00A49952

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 18ef36530a386955c1f91366c5c78f1ceecf97fb1fd972935b6b05ddbfe57f27
Instruction ID: ab2e71cb32f0820e8c5d48c305822b78d1f70440a03157e1890a8728b78f238f
Opcode Fuzzy Hash: 18ef36530a386955c1f91366c5c78f1ceecf97fb1fd972935b6b05ddbfe57f27
Instruction Fuzzy Hash: 611132361462409FDB128F65EC55EEB3B20AF92325B190159F9829B1B3CB324913CB50

Function 00A62DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00A5F2DE,00A63863,00B01444,?,00A4FDF5,?,?,00A3A976,00000010,00B01440,00A313FC,?,00A313C6), ref: 00A62DFD
_free.LIBCMT ref: 00A62E32
_free.LIBCMT ref: 00A62E59
SetLastError.KERNEL32(00000000,00A31129), ref: 00A62E66
SetLastError.KERNEL32(00000000,00A31129), ref: 00A62E6F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 737c068671ffcacc3418c3576a29b90a4f1ccd31470b4929c61ae93e28aeecaf
Instruction ID: ff5f0efadc145767f9c2272ea531b3867e0084caa7be4cc594aad47f032974f8
Opcode Fuzzy Hash: 737c068671ffcacc3418c3576a29b90a4f1ccd31470b4929c61ae93e28aeecaf
Instruction Fuzzy Hash: 5101F936645E0067C71267B56E45F2B1D7DABD13B1B250134F425922D2EB258C024320

Function 00A9000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?,?,00A9035E), ref: 00A9002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?), ref: 00A90046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?), ref: 00A90054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?), ref: 00A90064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A8FF41,80070057,?,?), ref: 00A90070

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 310b92ca0d0c19a49323ea5e3430ae78aea0e50ac8ba42c3ed42a6b129270cb5
Instruction ID: fe934fe27d5d036e9d02b79932ef340c823bcd43968f1eed9a45b37a5bde9199
Opcode Fuzzy Hash: 310b92ca0d0c19a49323ea5e3430ae78aea0e50ac8ba42c3ed42a6b129270cb5
Instruction Fuzzy Hash: 3C018B72700204BFDF108FA8DC04FAA7AEDEB447A2F154124F909D6210EB71DD418BA0

Function 00A910F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A91114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A91120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A9112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A90B9B,?,?,?), ref: 00A91136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A9114D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: cefdb16f3f6a2bccfdeb0176752f5348dceca84d51b437407cb1b4f667bfcc80
Instruction ID: a64f8703cc3ce30d1f9b76fafafa7e5d8f63f457f75bb0aa5756deecde08d159
Opcode Fuzzy Hash: cefdb16f3f6a2bccfdeb0176752f5348dceca84d51b437407cb1b4f667bfcc80
Instruction Fuzzy Hash: 0B016979200205BFDB118FA5DC4DE6A3BAEEF893A4B250418FA49C7360DB31DC028A60

Function 00A90FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A90FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A90FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A90FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A90FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A91002

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 768aa6648e7d33c113dd02b325685f504bc506b66b8a2ab578ff824d31e57fcc
Instruction ID: af7bb7f20eccb6eb8e5b82488723234150d2b2913c2befa77186bffdd019fb25
Opcode Fuzzy Hash: 768aa6648e7d33c113dd02b325685f504bc506b66b8a2ab578ff824d31e57fcc
Instruction Fuzzy Hash: 19F04939200312EBDB218FA5AC49F563BADFF89762F164424FA4AC6251CA71DC42CA60

Function 00A91014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A9102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A91036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A91045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A9104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A91062

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ca5d6f9cafd8a8d0c2bb6879cd06825a2447a3ea3573da0f9eb1f40c27228950
Instruction ID: f32b4977c406294599ba761bc0cab0c7cedc02074c33f1cafd26b05c79ee009d
Opcode Fuzzy Hash: ca5d6f9cafd8a8d0c2bb6879cd06825a2447a3ea3573da0f9eb1f40c27228950
Instruction Fuzzy Hash: E6F06D39200312EBDB219FE5EC49F563BADFF897A1F560524FA49C7250CA71D8428A60

Function 00AA030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00AA017D,?,00AA32FC,?,00000001,00A72592,?), ref: 00AA0324
CloseHandle.KERNEL32(?,?,?,?,00AA017D,?,00AA32FC,?,00000001,00A72592,?), ref: 00AA0331
CloseHandle.KERNEL32(?,?,?,?,00AA017D,?,00AA32FC,?,00000001,00A72592,?), ref: 00AA033E
CloseHandle.KERNEL32(?,?,?,?,00AA017D,?,00AA32FC,?,00000001,00A72592,?), ref: 00AA034B
CloseHandle.KERNEL32(?,?,?,?,00AA017D,?,00AA32FC,?,00000001,00A72592,?), ref: 00AA0358
CloseHandle.KERNEL32(?,?,?,?,00AA017D,?,00AA32FC,?,00000001,00A72592,?), ref: 00AA0365

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e3690ca0d45d85407201e3293982bd0dbbe3748c24af3ff901eb676f9bbcc16f
Instruction ID: c68edd5d55d93f812530a38568b3147a5ee84d1df7617d4f4b005a027cd119a0
Opcode Fuzzy Hash: e3690ca0d45d85407201e3293982bd0dbbe3748c24af3ff901eb676f9bbcc16f
Instruction Fuzzy Hash: C601AE72800B159FCB30AF66D880812FBF9BF613153158A3FD19696971C3B1A959DF90

Function 00A6D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A6D752

Part of subcall function 00A629C8: HeapFree.KERNEL32(00000000,00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000), ref: 00A629DE
Part of subcall function 00A629C8: GetLastError.KERNEL32(00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000,00000000), ref: 00A629F0

_free.LIBCMT ref: 00A6D764
_free.LIBCMT ref: 00A6D776
_free.LIBCMT ref: 00A6D788
_free.LIBCMT ref: 00A6D79A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e8d01e9e3cd69c95c03f1afb9e7042f56df0c4d5d3df6605257b467526f7c55d
Instruction ID: 0114805af4f7e24697d82ed5b1b4b7972734b9656296d3b816f44d5af42df5d9
Opcode Fuzzy Hash: e8d01e9e3cd69c95c03f1afb9e7042f56df0c4d5d3df6605257b467526f7c55d
Instruction Fuzzy Hash: 3DF0FF33B44608ABC625EBA5FAC5D2677FDBB847A0B940805F048E7501CB20FC80C7A5

Function 00A95C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A95C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A95C6F
MessageBeep.USER32(00000000), ref: 00A95C87
KillTimer.USER32(?,0000040A), ref: 00A95CA3
EndDialog.USER32(?,00000001), ref: 00A95CBD

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 7f033f7c9a421b0608ae689e4e506c29980b1c17aff4b62f393c8a57f1dee3c2
Instruction ID: 60402186f0e1a89d06cb02a727c8a27d41d1c180adcb98fd65db87bf4412b34d
Opcode Fuzzy Hash: 7f033f7c9a421b0608ae689e4e506c29980b1c17aff4b62f393c8a57f1dee3c2
Instruction Fuzzy Hash: 33018130A00B04ABEF259B60DE4FFA677F8BB00B05F011559F687A15E1DBF0A9858B90

Function 00A622A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A622BE

Part of subcall function 00A629C8: HeapFree.KERNEL32(00000000,00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000), ref: 00A629DE
Part of subcall function 00A629C8: GetLastError.KERNEL32(00000000,?,00A6D7D1,00000000,00000000,00000000,00000000,?,00A6D7F8,00000000,00000007,00000000,?,00A6DBF5,00000000,00000000), ref: 00A629F0

_free.LIBCMT ref: 00A622D0
_free.LIBCMT ref: 00A622E3
_free.LIBCMT ref: 00A622F4
_free.LIBCMT ref: 00A62305

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3ecff1d922aeb6c944bf011c69979867aa863c5b67e8845a9eb1ff4fc3accf4b
Instruction ID: 79db7531eaee045423f59212411228bd7eb269cd2c2b2ae0a47d9394c1db1188
Opcode Fuzzy Hash: 3ecff1d922aeb6c944bf011c69979867aa863c5b67e8845a9eb1ff4fc3accf4b
Instruction Fuzzy Hash: F1F030715109158BC71AFFE8BD01A583BB4B7B87A1B00054AF411D3271CF300411ABE5

Function 00A495C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00A495D4
StrokeAndFillPath.GDI32(?,?,00A871F7,00000000,?,?,?), ref: 00A495F0
SelectObject.GDI32(?,00000000), ref: 00A49603
DeleteObject.GDI32 ref: 00A49616
StrokePath.GDI32(?), ref: 00A49631

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: b7a38b8f1b9e1a8e1ad385cc63d929f78c693744b92b1c99375ef9444cf31d6c
Instruction ID: 78bb2e179d0ab216447d58a7c37f6a3d9dd1f28cf3ba63e442975a815a7ecfff
Opcode Fuzzy Hash: b7a38b8f1b9e1a8e1ad385cc63d929f78c693744b92b1c99375ef9444cf31d6c
Instruction Fuzzy Hash: DFF04935006208EFDB2A9FA9ED1CB667F61BB60332F158214F469560F0CB3089A7DF21

Function 00A60F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00A610F9
__freea.LIBCMT ref: 00A61117

Part of subcall function 00A61537: _free.LIBCMT ref: 00A6154F

Strings

am/pm, xrefs: 00A6117A
a/p, xrefs: 00A611DE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: a4ca9279f6ef78131a3609e83410e3e7433fde5603f8b6b7465e3d7b5f381716
Instruction ID: bfa78b959b1421f537d0bec803e2f5ee32e7148acb80cad4600835a62b97b2de
Opcode Fuzzy Hash: a4ca9279f6ef78131a3609e83410e3e7433fde5603f8b6b7465e3d7b5f381716
Instruction Fuzzy Hash: 07D1F171900206DADB659F68C895BFABFB1FF06700F2C4269EA069F750E3359D81CB91

Function 00AB7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00A50242: EnterCriticalSection.KERNEL32(00B0070C,00B01884,?,?,00A4198B,00B02518,?,?,?,00A312F9,00000000), ref: 00A5024D
Part of subcall function 00A50242: LeaveCriticalSection.KERNEL32(00B0070C,?,00A4198B,00B02518,?,?,?,00A312F9,00000000), ref: 00A5028A

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A500A3: __onexit.LIBCMT ref: 00A500A9

__Init_thread_footer.LIBCMT ref: 00AB7BFB

Part of subcall function 00A501F8: EnterCriticalSection.KERNEL32(00B0070C,?,?,00A48747,00B02514), ref: 00A50202
Part of subcall function 00A501F8: LeaveCriticalSection.KERNEL32(00B0070C,?,00A48747,00B02514), ref: 00A50235

Strings

G, xrefs: 00AB7C7F
5, xrefs: 00AB7C78
Variable must be of type 'Object'., xrefs: 00AB7C3A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: b8b318f3e3c281f2ec0b7c61f29f2b4ac26174a9c7efbcb14ff846c0da20590e
Instruction ID: be95785bd92a2605257c000d8a8dbd998175f3dc7eae08eee3afca31e6d0ef23
Opcode Fuzzy Hash: b8b318f3e3c281f2ec0b7c61f29f2b4ac26174a9c7efbcb14ff846c0da20590e
Instruction Fuzzy Hash: 4E918D74A04209AFCB14EF94D991DFDBBB9FF85340F108059F8069B292DBB1AE45CB51

Function 00A92716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A9B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A921D0,?,?,00000034,00000800,?,00000034), ref: 00A9B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A92760

Part of subcall function 00A9B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A921FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00A9B3F8

Part of subcall function 00A9B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00A9B355
Part of subcall function 00A9B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A92194,00000034,?,?,00001004,00000000,00000000), ref: 00A9B365
Part of subcall function 00A9B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A92194,00000034,?,?,00001004,00000000,00000000), ref: 00A9B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A927CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A9281A

Strings

@, xrefs: 00A92832

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 9ccef6f10ed5a7675ff84e0d6fa8cb11a24e7fd10427770afd33fbd246c95d00
Instruction ID: b072a8e31f8319917145c89368e3befe4f3d69abd8845d3728cfdc8fd9f087aa
Opcode Fuzzy Hash: 9ccef6f10ed5a7675ff84e0d6fa8cb11a24e7fd10427770afd33fbd246c95d00
Instruction Fuzzy Hash: FA410976A00218BEDF10DFA4DA45FEEBBB8AF09700F108095FA55B7181DA706E45DBA1

Function 00A6172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00A61769
_free.LIBCMT ref: 00A61834
_free.LIBCMT ref: 00A6183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00A61760, 00A61767, 00A61796, 00A617CE

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 8b51b4ccc08235651e7fa54a5db9b99984582b80ec427dfea2b3e5fe031b66fd
Instruction ID: 4f0537adf5dee5299fdf6b962def88970dbcf10ab8b0d48cb08345fd8315e264
Opcode Fuzzy Hash: 8b51b4ccc08235651e7fa54a5db9b99984582b80ec427dfea2b3e5fe031b66fd
Instruction Fuzzy Hash: 65317CB1A00218AFDB25DF99DD85D9EBFFCEB95310F1841AAF805D7211DA708E40CBA0

Function 00A9C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A9C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00A9C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B01990,01595118), ref: 00A9C395

Strings

0, xrefs: 00A9C2DF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 13d247ca316afba7f8ff2ff579a5640e97efebfeec7b4439cc68cb5b49e59ea9
Instruction ID: 923dba3aeaf8f47d9080e84273c144777c0c9e0626d0da48d50dc5150070af17
Opcode Fuzzy Hash: 13d247ca316afba7f8ff2ff579a5640e97efebfeec7b4439cc68cb5b49e59ea9
Instruction Fuzzy Hash: FC41BE712447019FDB20DF28D884B5BBBE8AF89320F108A1DF8A59B2D1D770E904CB62

Function 00AC4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00ACCC08,00000000,?,?,?,?), ref: 00AC44AA
GetWindowLongW.USER32 ref: 00AC44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AC44D7

Strings

SysTreeView32, xrefs: 00AC447C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: e1818ae691cbb0cd14a79067965b5c87d2bcb35f170e7fed9a3d746856508f18
Instruction ID: f718c50cf4f72da90dd1db89bc21a1858a632434bf5cc1fef7d945c58af94051
Opcode Fuzzy Hash: e1818ae691cbb0cd14a79067965b5c87d2bcb35f170e7fed9a3d746856508f18
Instruction Fuzzy Hash: 5E31AB31210609AFDB248F78DD45FEA7BA9EB48334F228719F979921E0DB70EC519B50

Function 00AB304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00AB3077,?,?), ref: 00AB3378

inet_addr.WSOCK32(?), ref: 00AB307A
_wcslen.LIBCMT ref: 00AB309B
htons.WSOCK32(00000000), ref: 00AB3106

Strings

255.255.255.255, xrefs: 00AB3095, 00AB309A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 2974e1c53af392b93547a7fd5271dbbdb65390cd944814b9e8d21e70b62db7b9
Instruction ID: ce245f57f195c7899247e0ca3b8805b7701853ab8d3d053b918349e131918e82
Opcode Fuzzy Hash: 2974e1c53af392b93547a7fd5271dbbdb65390cd944814b9e8d21e70b62db7b9
Instruction Fuzzy Hash: D131E13A6002019FCF10DF68D985EAA77F8EF14318F248159E9158B393DB72EE45CB60

Function 00AC3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00AC3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00AC3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00AC3F78

Strings

SysMonthCal32, xrefs: 00AC3F0B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 0c2570df6e227a4428db97fe1a1d17e7d1a71f05152e4ed5d4af1c1802b677ff
Instruction ID: 52676cc5453a3ce88900b4bc84193d13a5268fc5d9653a886db41526fa3f163c
Opcode Fuzzy Hash: 0c2570df6e227a4428db97fe1a1d17e7d1a71f05152e4ed5d4af1c1802b677ff
Instruction Fuzzy Hash: 5F21BF33600219BFDF15CF94CC46FEA3BB9EF48724F124218FA156B1D0D6B5A9508B90

Function 00AC4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00AC4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00AC4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00AC471A

Strings

msctls_updown32, xrefs: 00AC4684

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 8c5a52b22112f4a2e37097f63b5c0106dbb793f132205bc1b29e6fc8790ca535
Instruction ID: d0eaab7669f790e1451602cd05e00677797458badf507447c9419f602906ccc8
Opcode Fuzzy Hash: 8c5a52b22112f4a2e37097f63b5c0106dbb793f132205bc1b29e6fc8790ca535
Instruction Fuzzy Hash: 092160B5600208AFEB10DF68DCD1EB737ADEB5A3A4B050459FA049B351DB30EC52CB60

Function 00A995AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A9961D

Strings

#OnAutoItStartRegister, xrefs: 00A995F3
#requireadmin, xrefs: 00A995D9
#notrayicon, xrefs: 00A995B7

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: a13e743b30f71ae6a22812b8d1f1fb6db6b3fbd646388d11c269c6fd55c86ca2
Instruction ID: 0e82d3b1573a277e4e2c3ae50035ee09d6ee8bc25fe2f168880c55b6a529a475
Opcode Fuzzy Hash: a13e743b30f71ae6a22812b8d1f1fb6db6b3fbd646388d11c269c6fd55c86ca2
Instruction Fuzzy Hash: CF213872304510BAEB31AB2C9D03FBBB3E8AF91310F11442EFE49A7041EB65AD49C2D5

Function 00AC37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00AC3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00AC3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00AC3876

Strings

Listbox, xrefs: 00AC380F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 2327177bd5c86118211f2e1d6d53fbfd2c4971b050bc6c0ab591a5dee8776df9
Instruction ID: e5440b9a44a295ef6e1db89696c81e753429c45bf0b33762e1acd1cd95cffa8d
Opcode Fuzzy Hash: 2327177bd5c86118211f2e1d6d53fbfd2c4971b050bc6c0ab591a5dee8776df9
Instruction Fuzzy Hash: 80217F72610218BBEF11DF94DC85FBB376AEF89760F12C118F9159B190CA759C5287A0

Function 00AA49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AA4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00AA4A5C
SetErrorMode.KERNEL32(00000000,?,?,00ACCC08), ref: 00AA4AD0

Strings

%lu, xrefs: 00AA4A6F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 69b797c2a69085ba6676d0903867384e07a00119b852c66c1a481620a8ade9fd
Instruction ID: 83087ae0321a17be64c4b6dbe49eb92a7defc6ccf1de3a4260cbe15e759aa33a
Opcode Fuzzy Hash: 69b797c2a69085ba6676d0903867384e07a00119b852c66c1a481620a8ade9fd
Instruction Fuzzy Hash: 5C317175A00108AFDB10DF94C985EAA7BF8EF49318F1480A9F909DB252D771ED46CB61

Function 00AC41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00AC424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00AC4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00AC4271

Strings

msctls_trackbar32, xrefs: 00AC4226

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 824890d112250e49ff4b254daf7d206bf0a9917b56b261a8345642957186718f
Instruction ID: c7eb44d4e6b5bf1bf9f377387eda2b89c81b72b66754c12a05b98ebbd971091c
Opcode Fuzzy Hash: 824890d112250e49ff4b254daf7d206bf0a9917b56b261a8345642957186718f
Instruction Fuzzy Hash: 82110631240208BEEF205F68CC06FEB3BACEF99B64F024518FA55E2090D671DC519B14

Function 00A92F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A36B57: _wcslen.LIBCMT ref: 00A36B6A

Part of subcall function 00A92DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A92DC5
Part of subcall function 00A92DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A92DD6
Part of subcall function 00A92DA7: GetCurrentThreadId.KERNEL32 ref: 00A92DDD
Part of subcall function 00A92DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A92DE4

GetFocus.USER32 ref: 00A92F78

Part of subcall function 00A92DEE: GetParent.USER32(00000000), ref: 00A92DF9

GetClassNameW.USER32(?,?,00000100), ref: 00A92FC3
EnumChildWindows.USER32(?,00A9303B), ref: 00A92FEB

Strings

%s%d, xrefs: 00A92FFF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 249769d1ebd2c0ee0528e66c0a8bc7eadadfe4923eb658830027b5bf117ad4e5
Instruction ID: 859c17253886d5f8ece41d46be08d638b2049bf843fe05815af56d3e3020cc69
Opcode Fuzzy Hash: 249769d1ebd2c0ee0528e66c0a8bc7eadadfe4923eb658830027b5bf117ad4e5
Instruction Fuzzy Hash: 3E11B4717002057BCF14BFB08D89FED77AAAF84314F048075FA099B252DE309A468B60

Function 00AC5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00AC58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00AC58EE
DrawMenuBar.USER32(?), ref: 00AC58FD

Strings

0, xrefs: 00AC588F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: a4c1ba3a8b0c5318a3055a7ff93e7df2f229d1ce33f7718fb6769fe45078d390
Instruction ID: 11a71a4f60bda5f5487884890232617ff401a49736cbeb14a17f28eafe4e87e4
Opcode Fuzzy Hash: a4c1ba3a8b0c5318a3055a7ff93e7df2f229d1ce33f7718fb6769fe45078d390
Instruction Fuzzy Hash: 63018B31900218EEDB209F61DC45FAEBBB8FB85361F008099F848D6151DB309A81DF20

Function 00A8D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00A8D3BF
FreeLibrary.KERNEL32 ref: 00A8D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00A8D3B9
X64, xrefs: 00A8D2A8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 3028696f9b4bace98d81978fd99d42d1060ec853207447401ddb716d90097047
Instruction ID: 506280d00c9c25be97e728fd58c0cda6f04656c102d8e37b4b542de66f8ab1f1
Opcode Fuzzy Hash: 3028696f9b4bace98d81978fd99d42d1060ec853207447401ddb716d90097047
Instruction Fuzzy Hash: 3DF05536801621BBC33273104C14EA9B334EF00B01B5A8658F806EA1C4EB20CD418382

Function 00A9007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda342615173d2454b0161ca2151f578a6206e61966c8a27a961a4690513daa2
Instruction ID: 0aa773fdaaa8c1919182a968691fdd2e3f9aaab567556bdaad5ef5ee86eaf4b1
Opcode Fuzzy Hash: cda342615173d2454b0161ca2151f578a6206e61966c8a27a961a4690513daa2
Instruction Fuzzy Hash: 68C14875A0021AAFCB14CFA8C898EAEB7F5FF48744F218598E905EB251D731ED41DB90

Function 00A63E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A63F0B
__alldvrm.LIBCMT ref: 00A6410C
__alldvrm.LIBCMT ref: 00A6412E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: bfac8d70ae33fa63f554a16c7b0741bfb54e7b415460bf49d02ae9e845587811
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: C6A17E72E003569FEB25CF18C8917AEBFF4EF6A350F15426DE5559B282C2388D82C750

Function 00AB342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AB3459
CoUninitialize.OLE32 ref: 00AB3463
VariantInit.OLEAUT32(?), ref: 00AB346E
VariantClear.OLEAUT32(?), ref: 00AB371B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: d0be83d13c4c490d67e97b12c2680c2f0a9d74c2ebea2da57afbe6dc6c7b10e1
Instruction ID: dc7eb835262ca73a64482a85fbdce09a4da6d6afb6ac7be709c5c950c6d9d707
Opcode Fuzzy Hash: d0be83d13c4c490d67e97b12c2680c2f0a9d74c2ebea2da57afbe6dc6c7b10e1
Instruction Fuzzy Hash: 36A16D766043009FCB14DF29C595A6EB7E9FF88714F048959F98A9B362DB30EE01CB91

Function 00A90436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00ACFC08,?), ref: 00A905F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00ACFC08,?), ref: 00A90608
CLSIDFromProgID.OLE32(?,?,00000000,00ACCC40,000000FF,?,00000000,00000800,00000000,?,00ACFC08,?), ref: 00A9062D
_memcmp.LIBVCRUNTIME ref: 00A9064E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 19163008b7ab3c0e3547a25e8015e046cee6af0123ef336170702edc9ad99b3c
Instruction ID: 48a2acfc4735d566e5ea5af706ac8112a2208a8e351b9095bca51f9121d859b0
Opcode Fuzzy Hash: 19163008b7ab3c0e3547a25e8015e046cee6af0123ef336170702edc9ad99b3c
Instruction Fuzzy Hash: A081D675A00109AFCF04DF98C984EEEB7B9FF89355F208558E516AB250DB71AE06CB60

Function 00A71391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A714C0

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c5ea65f4c20a47f9c95eecd352824a508bbd60fea2efffc7affe79efeaa491a3
Instruction ID: efc86c980f91208037da9d198ecce37fde6733e6e4b0105a5ccab6517b19eff2
Opcode Fuzzy Hash: c5ea65f4c20a47f9c95eecd352824a508bbd60fea2efffc7affe79efeaa491a3
Instruction Fuzzy Hash: 4E415DB6A00600ABDB256BFD8D46ABE3AF5FF41770F14C625F81ED7292E63488425361

Function 00AC6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AC62E2
ScreenToClient.USER32(?,?), ref: 00AC6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00AC6382

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 023d86156b7d697f78b573a51246e5342b9f22969e9877d6c46cef8d3e40fa1d
Instruction ID: 7c19342b4f75e8e24346ef909788c43039f194a4db1c32a14102caed4f9f0082
Opcode Fuzzy Hash: 023d86156b7d697f78b573a51246e5342b9f22969e9877d6c46cef8d3e40fa1d
Instruction Fuzzy Hash: 23511874A00649EFCB14DF68D980EAE7BB5FB95360F11856DF8259B2A0D730AD81CB50

Function 00AB1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00AB1AFD
WSAGetLastError.WSOCK32 ref: 00AB1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00AB1B8A
WSAGetLastError.WSOCK32 ref: 00AB1B94

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: c91809e44c6acb49f91ef3ec4f1f70d29a39e4965ec1d234370c21c6d4fb44cb
Instruction ID: ed61c4da37f03dbd109c01ab58a15b7a8879b46a9fb30ca2a616aeb978e613f2
Opcode Fuzzy Hash: c91809e44c6acb49f91ef3ec4f1f70d29a39e4965ec1d234370c21c6d4fb44cb
Instruction Fuzzy Hash: E741BF78600200AFE720AF24C986F6A77E5AB44718F548448FA1A9F3D3D772ED428B90

Function 00A6B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7c4cc19b2ce528714b3d8ff5f476000234fbb02da0ef15a2637486cc85c1f9
Instruction ID: ac9bedb4699f9d8d8ab72fc1161b5ac6f48000497992d1f6569acafb218c755d
Opcode Fuzzy Hash: bc7c4cc19b2ce528714b3d8ff5f476000234fbb02da0ef15a2637486cc85c1f9
Instruction Fuzzy Hash: 63415B71A10314BFD724AF38CD45BAEBBF9EB84710F10852EF556DB281D771998187A0

Function 00AA56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00AA5783
GetLastError.KERNEL32(?,00000000), ref: 00AA57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00AA57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00AA57FA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 163e93431781c45f0e6d8d2dbb2ed9f8d6866ceae7ff01f7af55d64286fcfbab
Instruction ID: e9d8b82360df7e45dcfb13ba4ba27e6d44e352db618a041c9dd2b40e01a27d3a
Opcode Fuzzy Hash: 163e93431781c45f0e6d8d2dbb2ed9f8d6866ceae7ff01f7af55d64286fcfbab
Instruction Fuzzy Hash: 7D412D3A600610DFCB25EF55C544A5DBBE2EF49720F198888F84A6B362CB34FD01CB91

Function 00A6D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00A56D71,00000000,00000000,00A582D9,?,00A582D9,?,00000001,00A56D71,8BE85006,00000001,00A582D9,00A582D9), ref: 00A6D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A6D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A6D9AB
__freea.LIBCMT ref: 00A6D9B4

Part of subcall function 00A63820: RtlAllocateHeap.NTDLL(00000000,?,00B01444,?,00A4FDF5,?,?,00A3A976,00000010,00B01440,00A313FC,?,00A313C6,?,00A31129), ref: 00A63852

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 24948018812c460a8329e98f926b392e629979ba6c3284a85aa4f6ffbdd57f73
Instruction ID: 648a7d7652c799e42f718b86e9c8cfc8f4d3377c4f7a3cefdbb3eea6a6bc9ef7
Opcode Fuzzy Hash: 24948018812c460a8329e98f926b392e629979ba6c3284a85aa4f6ffbdd57f73
Instruction Fuzzy Hash: CB31BC72A0020AABDF25DFA5DC45EAF7BB5EB41750B054268FC08DB250EB35CD55CBA0

Function 00AC52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00AC5352
GetWindowLongW.USER32(?,000000F0), ref: 00AC5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AC5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00AC53A8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 0047d5bedd01df69123948f9c222f807a6c3af82c0934d25c8aec0827f3ff6d3
Instruction ID: 189c26d52350547b9ac335d6fafcedf7b2b192e80a95328da20b3538b139d050
Opcode Fuzzy Hash: 0047d5bedd01df69123948f9c222f807a6c3af82c0934d25c8aec0827f3ff6d3
Instruction Fuzzy Hash: EA31C134E55A88AFEB249F64CC25FE83761AB05390F5A410AFA109E3E1C7B0B9C09B41

Function 00A9AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00A9ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A9AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A9AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00A9ACC6

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 85a95e0a1322c36b3b5c3eadf1dc013cfb7e1ac26a45b22ec1c5cd91331a488f
Instruction ID: dda51c768cfe39f5f58e1b6fe38aa0715541b27ce631d1c416744449a03c173d
Opcode Fuzzy Hash: 85a95e0a1322c36b3b5c3eadf1dc013cfb7e1ac26a45b22ec1c5cd91331a488f
Instruction Fuzzy Hash: E2310530B40718AFEF35CBA98C04BFA7BF5ABA9321F04471BE4859A1D1C375898587D2

Function 00AC7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00AC769A
GetWindowRect.USER32(?,?), ref: 00AC7710
PtInRect.USER32(?,?,00AC8B89), ref: 00AC7720
MessageBeep.USER32(00000000), ref: 00AC778C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: df6ee7e4c32c3101ed719177a73e9f1c0ffddabf4435f298e55d4bb873efc5a8
Instruction ID: 2884de50b50e7490a8278ac02a2902bc3f0eabde28f73b883f9f133734d77b50
Opcode Fuzzy Hash: df6ee7e4c32c3101ed719177a73e9f1c0ffddabf4435f298e55d4bb873efc5a8
Instruction Fuzzy Hash: 32415A38A052189FCB11CFA8C894FADB7F5BB59314F1A41ADE8149B261C730A942CF90

Function 00AC16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00AC16EB

Part of subcall function 00A93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A93A57
Part of subcall function 00A93A3D: GetCurrentThreadId.KERNEL32 ref: 00A93A5E
Part of subcall function 00A93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A925B3), ref: 00A93A65

GetCaretPos.USER32(?), ref: 00AC16FF
ClientToScreen.USER32(00000000,?), ref: 00AC174C
GetForegroundWindow.USER32 ref: 00AC1752

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 5b7d10d8833212e272cd0a71fccb868de195fbb0b04bcea345f0167d3d881419
Instruction ID: aeaa7265ff7a7d923e272c82b237e232981af65686c122c7fac7fb5b6ab5ec1f
Opcode Fuzzy Hash: 5b7d10d8833212e272cd0a71fccb868de195fbb0b04bcea345f0167d3d881419
Instruction Fuzzy Hash: 8F314175E00249AFCB04EFA9C981DAEB7F9EF49314B5180A9E415E7212DB31DE45CFA0

Function 00A9DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00A37620: _wcslen.LIBCMT ref: 00A37625

_wcslen.LIBCMT ref: 00A9DFCB
_wcslen.LIBCMT ref: 00A9DFE2
_wcslen.LIBCMT ref: 00A9E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00A9E018

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: d7d5633164efddd7f921f20f04bb7ce4244ef7b934c6e348b59e90b2cdc83e7a
Instruction ID: 2d996c6e2ac565a9144853da885ea6d4e6e8cfee357dde97254dc6e77efb1e40
Opcode Fuzzy Hash: d7d5633164efddd7f921f20f04bb7ce4244ef7b934c6e348b59e90b2cdc83e7a
Instruction Fuzzy Hash: 37219F75A40214EFCF20DFA8DA82BAEB7F8EF85750F144065E805BB246D6709E41CBA1

Function 00A9D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A9D501
Process32FirstW.KERNEL32(00000000,?), ref: 00A9D50F
Process32NextW.KERNEL32(00000000,?), ref: 00A9D52F
CloseHandle.KERNEL32(00000000), ref: 00A9D5DC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f336e0c1d174fd1b7ba4ef25d0505cbe2a9ac22fecad55e02b3f4e036d79ccde
Instruction ID: 92030ef733f2016aa4add1b54cb414e3b6b50c635e697f944d624108c4a7afc1
Opcode Fuzzy Hash: f336e0c1d174fd1b7ba4ef25d0505cbe2a9ac22fecad55e02b3f4e036d79ccde
Instruction Fuzzy Hash: 3E319C711083009FD700EF64C985AAFBBF8EFD9354F14092DF585861A1EB719A89CBA3

Function 00AC8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

GetCursorPos.USER32(?), ref: 00AC9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00A87711,?,?,?,?,?), ref: 00AC9016
GetCursorPos.USER32(?), ref: 00AC905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00A87711,?,?,?), ref: 00AC9094

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 9e8aa0ea033ddf6a899a382988fbbf6a5097bd92c4df32adac2d1ee298c6d088
Instruction ID: 7a4eb19d0fbca43c091f6850ad51d95d2224dfa7f8ac0eba2ae5531358e0ac9d
Opcode Fuzzy Hash: 9e8aa0ea033ddf6a899a382988fbbf6a5097bd92c4df32adac2d1ee298c6d088
Instruction Fuzzy Hash: 49217C35600118EFDB258F98C858FEB7BF9EB89360F154069F9058B2A1C7319991DB61

Function 00A9D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00ACCB68), ref: 00A9D2FB
GetLastError.KERNEL32 ref: 00A9D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A9D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00ACCB68), ref: 00A9D376

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: b936265a115fe6e0424ca521248e05e202c166449462ecc9446a8cf555d2e88e
Instruction ID: 7ca124fba2a9ef0d8f9b68175b3ff56620e3f45d2f1cde30e555917257ec4626
Opcode Fuzzy Hash: b936265a115fe6e0424ca521248e05e202c166449462ecc9446a8cf555d2e88e
Instruction Fuzzy Hash: 0A2191746082019FCB00EF68C9818ABB7E4AE55365F104A1DF499DB2A1E730D986CB93

Function 00A91571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A9102A
Part of subcall function 00A91014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A91036
Part of subcall function 00A91014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A91045
Part of subcall function 00A91014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A9104C
Part of subcall function 00A91014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A91062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A915BE
_memcmp.LIBVCRUNTIME ref: 00A915E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A91617
HeapFree.KERNEL32(00000000), ref: 00A9161E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: b29982b145326a733972aff849cf7c15fe6f4ef3265208646b2eb38f67c08259
Instruction ID: 19882782de7d8e52c4c36a6a36f6383ddbec3bcc1b2866ce9c8ee8c157d48768
Opcode Fuzzy Hash: b29982b145326a733972aff849cf7c15fe6f4ef3265208646b2eb38f67c08259
Instruction Fuzzy Hash: 95219A72E4010AEFDF00DFA5C985BEEB7F8EF44354F0A4859E545AB241E730AA05CBA0

Function 00AC2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00AC280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00AC2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00AC2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00AC2840

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 39cf7f2e8ba1012909e74779a48500b0b194666e3da05ca75494178b4f9a1c4b
Instruction ID: b023d5a238ed6954f338d865566cffb91961404693c51d84e327a7eb4ec483c0
Opcode Fuzzy Hash: 39cf7f2e8ba1012909e74779a48500b0b194666e3da05ca75494178b4f9a1c4b
Instruction Fuzzy Hash: D921B035204615AFD714DB24CC95FAA7BA5AF85324F16815CF42ACB6E2CB71FC82CB90

Function 00A978F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A98D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00A9790A,?,000000FF,?,00A98754,00000000,?,0000001C,?,?), ref: 00A98D8C
Part of subcall function 00A98D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00A98DB2
Part of subcall function 00A98D7D: lstrcmpiW.KERNEL32(00000000,?,00A9790A,?,000000FF,?,00A98754,00000000,?,0000001C,?,?), ref: 00A98DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00A98754,00000000,?,0000001C,?,?,00000000), ref: 00A97923
lstrcpyW.KERNEL32(00000000,?), ref: 00A97949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A98754,00000000,?,0000001C,?,?,00000000), ref: 00A97984

Strings

cdecl, xrefs: 00A9797B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: afb509ee69e60ac22e348be105579e23ff5e2099605ddaa2a94b94f87dafa940
Instruction ID: 36a0f9abba9636a55a673de86eb6467075ad5eae554286883e070083dd92a99f
Opcode Fuzzy Hash: afb509ee69e60ac22e348be105579e23ff5e2099605ddaa2a94b94f87dafa940
Instruction Fuzzy Hash: C311033A300202AFCF159F35D845E7A77E9FF85350B10402AF906CB2A4EB319801C7A1

Function 00AC7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00AC7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00AC7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00AC7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00AAB7AD,00000000), ref: 00AC7D6B

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: dffe46e48f53e5708057b0a18f4d519dcc8cf7e906c36360ac8e3e8c8e5fec96
Instruction ID: 506422f681c162471720d9089acc66a9d9e5a8e67e67a131e6f401b87a1945d5
Opcode Fuzzy Hash: dffe46e48f53e5708057b0a18f4d519dcc8cf7e906c36360ac8e3e8c8e5fec96
Instruction Fuzzy Hash: C6115C32605615AFCB159F68DC04EAA3BA5AF45360F168728F83AD72F0DB309952DF50

Function 00AC5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00AC56BB
_wcslen.LIBCMT ref: 00AC56CD
_wcslen.LIBCMT ref: 00AC56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00AC5816

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 70efa0914ef39a5e3c1a8a59363181fac0052d9d5dbcfa39779570fd0cbb9629
Instruction ID: b83a3601b5af8f6eb399e1ad72290f3e5f5313fdaacda8d153cc224b68ac3ce3
Opcode Fuzzy Hash: 70efa0914ef39a5e3c1a8a59363181fac0052d9d5dbcfa39779570fd0cbb9629
Instruction Fuzzy Hash: E011BE71E00608A6DB20DFB5CD85FEE77BCAF11764B11846EF915D6081EB74AAC4CBA0

Function 00A61D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7a3c20c9d22cfa552dd504ae25f0d32bd9913eef9ecd20e7d591e23d833eba
Instruction ID: 0b42293e64fdbcf74682c05b03c22410d88658d3cf0c1927a212122eacfd0cc4
Opcode Fuzzy Hash: ac7a3c20c9d22cfa552dd504ae25f0d32bd9913eef9ecd20e7d591e23d833eba
Instruction Fuzzy Hash: B80181B2609A16BEF72227B96CC1F676A7DDF817B8F390325F521A12D2DB618C005270

Function 00A91A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A91A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A91A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A91A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A91A8A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2979b3b3f6b5aefea860aa1da66471887f77d6c4017c3824414b06f2c898d2d5
Instruction ID: dd03922f001b14ad29723a9c6d25ad8ffe2b52064a92be301e6d9feff4085aa7
Opcode Fuzzy Hash: 2979b3b3f6b5aefea860aa1da66471887f77d6c4017c3824414b06f2c898d2d5
Instruction Fuzzy Hash: 2011093AE01219FFEF11DBA5CD85FADBBB8EB08750F200091EA04B7290D6716E51DB94

Function 00A9E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A9E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00A9E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A9E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A9E24D

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 1aa08867f2b546ba5bb08bff662bc7263998ddfaedfbd5f336bba4bba8353368
Instruction ID: 2cda3766917dc97daefe07501992fc8145267c21ba08e4814e847e8cc8aa767c
Opcode Fuzzy Hash: 1aa08867f2b546ba5bb08bff662bc7263998ddfaedfbd5f336bba4bba8353368
Instruction Fuzzy Hash: 1B11C876A04254BBCF05DFEC9C05EDE7FECEB55720F154655F914D3292DA70890487A0

Function 00A5D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00A5CFF9,00000000,00000004,00000000), ref: 00A5D218
GetLastError.KERNEL32 ref: 00A5D224
__dosmaperr.LIBCMT ref: 00A5D22B
ResumeThread.KERNEL32(00000000), ref: 00A5D249

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: bd91ea61abec9d476183732cc1000fd02a4b836480b25f5f4b84d891b2c95d57
Instruction ID: 9423d5fbb3276f96b17a4b4d1c69f4639dc169c6d1e6af9976eca39c0f105f35
Opcode Fuzzy Hash: bd91ea61abec9d476183732cc1000fd02a4b836480b25f5f4b84d891b2c95d57
Instruction Fuzzy Hash: 8B01D276805204BBDB219BA6EC09BEE7E69FF81732F100319FD25961D0DB70890AC7A0

Function 00AC9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00A49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A49BB2

GetClientRect.USER32(?,?), ref: 00AC9F31
GetCursorPos.USER32(?), ref: 00AC9F3B
ScreenToClient.USER32(?,?), ref: 00AC9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00AC9F7A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 7156afdefa2149fc31f0faa3c9e9b6b81bfe1e1bca1451c8cdc69353213585f8
Instruction ID: 4aacf627f55c3a536aed7289a714c65456783abb9441e4adcf1b45a0ed190440
Opcode Fuzzy Hash: 7156afdefa2149fc31f0faa3c9e9b6b81bfe1e1bca1451c8cdc69353213585f8
Instruction Fuzzy Hash: 0311153690021AEBDB14DFA8D989EEF77B9FB45311F024459F912E3150D730BA92CBA1

Function 00A3600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A3604C
GetStockObject.GDI32(00000011), ref: 00A36060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00A3606A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 4e284112e6ab06a2a132b347e11db89ba1314bbe84d9c91707984ab60ebcfe07
Instruction ID: 590b27122b67b8011bdd62e98746508eeaea328e941048a566ee60125c0f7003
Opcode Fuzzy Hash: 4e284112e6ab06a2a132b347e11db89ba1314bbe84d9c91707984ab60ebcfe07
Instruction Fuzzy Hash: F311C072501508BFEF168FA4DC45EEABB6DFF0A3A5F058201FA0852010D732DC60DBA0

Function 00A53B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00A53B56

Part of subcall function 00A53AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00A53AD2
Part of subcall function 00A53AA3: ___AdjustPointer.LIBCMT ref: 00A53AED

_UnwindNestedFrames.LIBCMT ref: 00A53B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00A53B7C
CallCatchBlock.LIBVCRUNTIME ref: 00A53BA4

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 1efa26df27e5cb23fcd0b78d95de90d3c97c573741904870ea4149360173b265
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 0D012933100148BBDF126F95CD42EEB3B69FF98799F054014FE4896121C732E965DBA0

Function 00A63073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00A313C6,00000000,00000000,?,00A6301A,00A313C6,00000000,00000000,00000000,?,00A6328B,00000006,FlsSetValue), ref: 00A630A5
GetLastError.KERNEL32(?,00A6301A,00A313C6,00000000,00000000,00000000,?,00A6328B,00000006,FlsSetValue,00AD2290,FlsSetValue,00000000,00000364,?,00A62E46), ref: 00A630B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A6301A,00A313C6,00000000,00000000,00000000,?,00A6328B,00000006,FlsSetValue,00AD2290,FlsSetValue,00000000), ref: 00A630BF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 0d9da95f6bae83af0480b05ce5973cf2101063c8042398a5043c009cec6bdbc7
Instruction ID: d3a9cbefc0f21a6844b8963a8bf4dcc640137421cd0385135cc9b530d021923d
Opcode Fuzzy Hash: 0d9da95f6bae83af0480b05ce5973cf2101063c8042398a5043c009cec6bdbc7
Instruction Fuzzy Hash: E1018833751222ABCF318BB9AC44D5777B8DF45771B160620F91AD7140D721D907C6D0

Function 00A97464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00A9747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00A97497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00A974AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00A974CA

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: b763fc7491b84c5bdba3bb3562c5379e5fb9f999900da41eb3e0c7c646a2d7dd
Instruction ID: 3945594566d1767613d50eff0c8d3303646b6b0ed1302ac726f90d81fcbb4adc
Opcode Fuzzy Hash: b763fc7491b84c5bdba3bb3562c5379e5fb9f999900da41eb3e0c7c646a2d7dd
Instruction Fuzzy Hash: B711ADB5315310ABEB20CF58DD08F9A7BFCEF80B10F108569E61AD6192D7B0E904DBA0

Function 00A9B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A9ACD3,?,00008000), ref: 00A9B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A9ACD3,?,00008000), ref: 00A9B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A9ACD3,?,00008000), ref: 00A9B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A9ACD3,?,00008000), ref: 00A9B126

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3c0a85b39da74ae76fce832f4fdad618ff831db45cfe4af1dfd26e34a8d0ad4b
Instruction ID: 5c522c195133da1fdc5a121d6456949b910adabfcfc6a86021850426142c6baf
Opcode Fuzzy Hash: 3c0a85b39da74ae76fce832f4fdad618ff831db45cfe4af1dfd26e34a8d0ad4b
Instruction Fuzzy Hash: D1115E31E1152CD7CF00DFE5EA68AEEBBB8FF49711F114295D945B2141CB3055518B61

Function 00AC7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AC7E33
ScreenToClient.USER32(?,?), ref: 00AC7E4B
ScreenToClient.USER32(?,?), ref: 00AC7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC7E8A

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: b9b62f4a091d9f641532e784eb322f26fe75381c6fb3635b6789e33bdba2c495
Instruction ID: 7b99911ebef857ea0e205499de0637ed11d3cd3a02b3afd8c52ffc5c24939a6c
Opcode Fuzzy Hash: b9b62f4a091d9f641532e784eb322f26fe75381c6fb3635b6789e33bdba2c495
Instruction Fuzzy Hash: 481114B9D0024AAFDB41DF98C984AEEBBF5FF08310F515056E915E3210D735AA55CF50

Function 00A92DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A92DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A92DD6
GetCurrentThreadId.KERNEL32 ref: 00A92DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A92DE4

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 41fdb66be469080832d383d23222db1eb7a1894024c614f50cbf76853ee08548
Instruction ID: b71a69147f610accfb3e3b043bab5d68b9d9e2e4661d67f0c5bdeff4df3ea9e4
Opcode Fuzzy Hash: 41fdb66be469080832d383d23222db1eb7a1894024c614f50cbf76853ee08548
Instruction Fuzzy Hash: CDE06D71601224BAEB205BA29C0DFEB7EACEF42BB1F021115F10AD1080DAA08942C7B0

Function 00AC8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00A49639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A49693
Part of subcall function 00A49639: SelectObject.GDI32(?,00000000), ref: 00A496A2
Part of subcall function 00A49639: BeginPath.GDI32(?), ref: 00A496B9
Part of subcall function 00A49639: SelectObject.GDI32(?,00000000), ref: 00A496E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00AC8887
LineTo.GDI32(?,?,?), ref: 00AC8894
EndPath.GDI32(?), ref: 00AC88A4
StrokePath.GDI32(?), ref: 00AC88B2

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: aea46abd0b2e949968560d6a038915dea33370d3df11be02f7866e3a65c5ebd6
Instruction ID: ea46cc11008b13cffb2a435f4890bb3022dd9aa2ae5ba985195cb9d9f98a6065
Opcode Fuzzy Hash: aea46abd0b2e949968560d6a038915dea33370d3df11be02f7866e3a65c5ebd6
Instruction Fuzzy Hash: C8F05E36041258FADB129F94AC09FDE3F59AF16320F058104FA55650E1CB795522CFE5

Function 00A498B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00A498CC
SetTextColor.GDI32(?,?), ref: 00A498D6
SetBkMode.GDI32(?,00000001), ref: 00A498E9
GetStockObject.GDI32(00000005), ref: 00A498F1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: e912993c2a70ad0b64bcab19aad60772001bada8bc50196fa5a9bf9f6aedc3e5
Instruction ID: 5bb73fbc72eb9c8f67f10f64794b2f3cab031ea856068e1767982db35e635ca8
Opcode Fuzzy Hash: e912993c2a70ad0b64bcab19aad60772001bada8bc50196fa5a9bf9f6aedc3e5
Instruction Fuzzy Hash: 6CE06531644244AEDB219BB5BC09FDD3F10AB51335F188319F6FE540E1C37186519B10

Function 00A9162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A91634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A911D9), ref: 00A9163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A911D9), ref: 00A91648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A911D9), ref: 00A9164F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 448aeff7222941ab9d400bec6a10e9226914000fdfa23b65e5de019bff503b2b
Instruction ID: 235c8d0c4f2d1c7090246e0daeaf25d7e59db48f8b8745e2fbab83554e3b15ac
Opcode Fuzzy Hash: 448aeff7222941ab9d400bec6a10e9226914000fdfa23b65e5de019bff503b2b
Instruction Fuzzy Hash: 9EE08675A01211DBDB205FE4AD0DF863BBCBF447A5F194808F349C9080D6348542C750

Function 00A8D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A8D858
GetDC.USER32(00000000), ref: 00A8D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A8D882
ReleaseDC.USER32(?), ref: 00A8D8A3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 5365587873ca3907a41c399bc405936d82decebf9a934b093974d99da9cc2d4e
Instruction ID: ded43c589fd76c08d91d763bfe98f5b7566e2786d55deea5633d4ab79af7aa4f
Opcode Fuzzy Hash: 5365587873ca3907a41c399bc405936d82decebf9a934b093974d99da9cc2d4e
Instruction Fuzzy Hash: 20E09AB5800205DFCF41EFE4DA0CA6DBBB5FB48321F159459F84AE7250C7399942AF50

Function 00A8D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A8D86C
GetDC.USER32(00000000), ref: 00A8D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A8D882
ReleaseDC.USER32(?), ref: 00A8D8A3

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f1ed438b417d8abe24df12056e6399eeb19f95afab3673d56d3620ec0949722c
Instruction ID: f06fda44aebb7ee859a62cd24acf64b8d158aaeb6a78220b07483ccb322f7c0e
Opcode Fuzzy Hash: f1ed438b417d8abe24df12056e6399eeb19f95afab3673d56d3620ec0949722c
Instruction Fuzzy Hash: 16E092B5800204EFCF51EFE4DA0CA6DBBB5BB48321F159449F94AE7250CB399902AF50

Function 00AA4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00A37620: _wcslen.LIBCMT ref: 00A37625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00AA4ED4

Strings

LPT, xrefs: 00AA4DFB
*, xrefs: 00AA4E10

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 1436c0421cb3c7192264a8bde67981e1bad7e4641b4a1c2ec2e5afa89506ef08
Instruction ID: 6eefc98ca6e7a1de66e06b04519f8119c7af51f65f4432f3cd37773a3503aa28
Opcode Fuzzy Hash: 1436c0421cb3c7192264a8bde67981e1bad7e4641b4a1c2ec2e5afa89506ef08
Instruction Fuzzy Hash: A6914D75A002049FCB14DF58C585EAEBBF1AF89704F198099F80A9F3A2C775ED85CB91

Function 00A5E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00A5E30D

Strings

pow, xrefs: 00A5E2E5, 00A5E302

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: cc41a7b92507eb21d8e963c83ed6bd084045ebe1c33e181aaaa5f6746121e9b1
Instruction ID: e850980c812cd3f3bc4ffe920931cfd1a57af80a5f0ed06b1a3ef5d60639bae9
Opcode Fuzzy Hash: cc41a7b92507eb21d8e963c83ed6bd084045ebe1c33e181aaaa5f6746121e9b1
Instruction Fuzzy Hash: 5F517B71A2C20196CB19F714CA013BD3BB4BB10756F304D99E8D6862E9EB358DDADB42

Function 00A4E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00A4E1B1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: dda0aa73edc06364e22ff1ae89c7df0dbcae95ca46c48adf9d15212ce730e5b2
Instruction ID: 8a947db682ed707f69a9f96976523ddc034fc1f0436a67e3d2a404f281de8044
Opcode Fuzzy Hash: dda0aa73edc06364e22ff1ae89c7df0dbcae95ca46c48adf9d15212ce730e5b2
Instruction Fuzzy Hash: B4512139A04246DFDF15EF68C481AFA7BA8FFA5310F248159F8919B2D0D6749D42CBA0

Function 00A4F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00A4F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00A4F2BB

Strings

@, xrefs: 00A4F2AF

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: b20fb6871539af15b1c150fce7f06b3e3b35515c46505b803f99ec725f35d261
Instruction ID: cfa75d623d8672bc2aa62cf2c8504b5ebc60aa25e555f2080a81edeaec18d879
Opcode Fuzzy Hash: b20fb6871539af15b1c150fce7f06b3e3b35515c46505b803f99ec725f35d261
Instruction Fuzzy Hash: C65154724087889BD320EF50DD86BAFBBF8FB85310F81884CF1D9411A5EB308529CB66

Function 00AB5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00AB57E0
_wcslen.LIBCMT ref: 00AB57EC

Strings

CALLARGARRAY, xrefs: 00AB57E6, 00AB57EB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 391bc676d611a37fcc1bdf80ebfdb0582d2973533168ba30870fb054e02440cd
Instruction ID: d353e8ba5004269e2f1f2849e950a54a2752d81ecb8b4102611ea89684d78bb0
Opcode Fuzzy Hash: 391bc676d611a37fcc1bdf80ebfdb0582d2973533168ba30870fb054e02440cd
Instruction Fuzzy Hash: 05418D71E002099FCB14DFB9C981AEEBBF9FF99324F144069E505A7252E7709D81DB90

Function 00AAD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AAD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00AAD13A

Strings

|, xrefs: 00AAD10B

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: d4444d8b4705ce1d34b48aa36d32ed8de2627268f8f0f776202ea06f37a14653
Instruction ID: ad7169d34807980e871f7ce4b3880648028ae4a94b074850a2372a80eddb2fee
Opcode Fuzzy Hash: d4444d8b4705ce1d34b48aa36d32ed8de2627268f8f0f776202ea06f37a14653
Instruction Fuzzy Hash: 92314F71D00219ABCF15EFA4CD85EEEBFB9FF09300F104119F815A6161E735AA46CB50

Function 00AC356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00AC3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00AC365C

Strings

static, xrefs: 00AC35BC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 45def0a4745601bf4725fe0efa0ec9a8942bd5d779fd273e6c777822396839b3
Instruction ID: a01b167f48325f8c8b39a11c63f0b07f29643b4b1dbea2796c2f4c2975107c10
Opcode Fuzzy Hash: 45def0a4745601bf4725fe0efa0ec9a8942bd5d779fd273e6c777822396839b3
Instruction Fuzzy Hash: F8317A72110204AEDB14DF68DC81FBB73A9FF88720F02D61DF9A597280DA31AD819B60

Function 00AC4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00AC461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00AC4634

Strings

', xrefs: 00AC458E

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: c13bc2d2d403f14dbba09f6d20f8f147a60e4337c3b4702cdb714b48939eacd4
Instruction ID: 94970cdbac92f2cc88739d5b76c4524f519d780f594b526413d11984fd2978ba
Opcode Fuzzy Hash: c13bc2d2d403f14dbba09f6d20f8f147a60e4337c3b4702cdb714b48939eacd4
Instruction Fuzzy Hash: DF311874A013099FDB14CFA9C9A0FEABBB5FF49300F15406AE905AB355E770A941CF94

Function 00AC31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00AC327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00AC3287

Strings

Combobox, xrefs: 00AC3249

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: c72a6316c51cdd1b731dbb8f331c570cddd5254d7d33337c9b310d0b55645c63
Instruction ID: 5cfa2820b882521447f3ba572f1c2ff1174aa2bd35f9234276711bf94d0544aa
Opcode Fuzzy Hash: c72a6316c51cdd1b731dbb8f331c570cddd5254d7d33337c9b310d0b55645c63
Instruction Fuzzy Hash: 2C11E2723002087FEF259F94DC80FFB37AAEBA4364F128128F91897290D6759D518760

Function 00AC3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00A3600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A3604C
Part of subcall function 00A3600E: GetStockObject.GDI32(00000011), ref: 00A36060
Part of subcall function 00A3600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A3606A

GetWindowRect.USER32(00000000,?), ref: 00AC377A
GetSysColor.USER32(00000012), ref: 00AC3794

Strings

static, xrefs: 00AC3757

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1a87ead5400cff7feeef91842a4319dd2be98d586a12ed15bf4206e41234b2e3
Instruction ID: 38eddf9200670c2404f333fe86ec5b7ebf3e1695834748882372c7fa3231c797
Opcode Fuzzy Hash: 1a87ead5400cff7feeef91842a4319dd2be98d586a12ed15bf4206e41234b2e3
Instruction Fuzzy Hash: 041129B2610209AFDF01DFA8CC46EEA7BB8FB09314F018918F956E3250D735E9519B50

Function 00AACD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00AACD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00AACDA6

Strings

<local>, xrefs: 00AACD66

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 50535685a2ea98c1a3b2c9adbbec32ee124f4e977fa2e72de91d079a1e7a5989
Instruction ID: 944ffb88cfaa98869878089f61ca8e153c9e8aa0490a8bbd8ede08fe6e74c073
Opcode Fuzzy Hash: 50535685a2ea98c1a3b2c9adbbec32ee124f4e977fa2e72de91d079a1e7a5989
Instruction Fuzzy Hash: 2411CE71205636BAE7384BA68C89EF7BEACEF137B4F00422AB119831C0D7749941D6F0

Function 00AC3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00AC34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00AC34BA

Strings

edit, xrefs: 00AC348F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 18accf41b6ddb9bfc298b05a896c86987299c15fc2132e9a0336575ba2cf1b4f
Instruction ID: 8ae3f158660d280bfb88dddced5a2ada6efa61bbf60c1ec0c9d87561997d97a9
Opcode Fuzzy Hash: 18accf41b6ddb9bfc298b05a896c86987299c15fc2132e9a0336575ba2cf1b4f
Instruction Fuzzy Hash: B9119D72100208AAEF158F64DD40FAA376AEB05375F528728F965971D0C735DC519B50

Function 00A96C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

CharUpperBuffW.USER32(?,?,?), ref: 00A96CB6
_wcslen.LIBCMT ref: 00A96CC2

Strings

STOP, xrefs: 00A96CBC, 00A96CC1

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: bb07c66bde0ce115a2f91b957867173026becb5488f4098753750baf2a51abd0
Instruction ID: f2f652c59c728cfe67f0c33358935ca59d6f88e169375776889112e6c85f0833
Opcode Fuzzy Hash: bb07c66bde0ce115a2f91b957867173026becb5488f4098753750baf2a51abd0
Instruction Fuzzy Hash: CD01C032B149268BCF21AFFDDD819BF77F5EE65714B110528F86296190EB31E940C650

Function 00A91CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A91D4C

Strings

ListBox, xrefs: 00A91D16
ComboBox, xrefs: 00A91CEB

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: aa4bfc83a85084fe3cf1294a377f7fe0dde05ee684bf44da379aaec38537dcec
Instruction ID: 04675c2c41e4fedcdfb49e3b8da8f2bbc15182333f34e9e84b1034fabbbdad09
Opcode Fuzzy Hash: aa4bfc83a85084fe3cf1294a377f7fe0dde05ee684bf44da379aaec38537dcec
Instruction Fuzzy Hash: 4501B171B01219AB8F08EBA4CE55CFF77E8FB46390B440A19F822672C1EA7059088660

Function 00A91BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A91C46

Strings

ListBox, xrefs: 00A91C10
ComboBox, xrefs: 00A91BE5

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 83a75e406fba00c17980a09c0c98253be4b5df1d4fe508bff3b5d7c1385e7915
Instruction ID: 38d1ea639c0fd9bdc2f86031ca595db864990e1977822541edb9c8b35712de5c
Opcode Fuzzy Hash: 83a75e406fba00c17980a09c0c98253be4b5df1d4fe508bff3b5d7c1385e7915
Instruction Fuzzy Hash: 8A01A275B851097BCF05EBA0CB52EFF77E89F51340F140019F91667281EA649E0CC6B2

Function 00A91C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A91CC8

Strings

ListBox, xrefs: 00A91C94
ComboBox, xrefs: 00A91C69

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ab0cc8bdb99ea97a5142096e9700357496b0e9b7331f67afe78118c3dd9ffe72
Instruction ID: a077f64d240e2df6611aed6a9be57aff35aa2e3b6c561f48f876c7a4c9bc3206
Opcode Fuzzy Hash: ab0cc8bdb99ea97a5142096e9700357496b0e9b7331f67afe78118c3dd9ffe72
Instruction Fuzzy Hash: 3701D1B6B801197BCF04EBA0CB02EFF77E8AB11340F540415B902B3281EAA09F18C672

Function 00A91D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A39CB3: _wcslen.LIBCMT ref: 00A39CBD

Part of subcall function 00A93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A93CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00A91DD3

Strings

ListBox, xrefs: 00A91DA0
ComboBox, xrefs: 00A91D75

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 58686db1092e181e137b0e70241161b53c17c341b4a461c997d8a4dd3acfc214
Instruction ID: f9cdfb109abca9455a9a06288a0851fdb9f444577bcc1e35bf8a7ce0b6b71a99
Opcode Fuzzy Hash: 58686db1092e181e137b0e70241161b53c17c341b4a461c997d8a4dd3acfc214
Instruction Fuzzy Hash: F8F0AF75B412196BDF04E7A4CE52EFF77F8AB02350F040D19F922A72C1EAA05A0882A1

Function 00AB747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AB7493
_wcslen.LIBCMT ref: 00AB74B9

Strings

3, 3, 16, 1, xrefs: 00AB7483

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 71eef213f44a4f09e458597c32ee6bcd421236c3a253ef25cb5fbac3a8df3e24
Instruction ID: 24f13944c8e6042327745d789026fa6946c02e9887b6877ec66f51648f443c10
Opcode Fuzzy Hash: 71eef213f44a4f09e458597c32ee6bcd421236c3a253ef25cb5fbac3a8df3e24
Instruction Fuzzy Hash: 29E02B0260422060923113799DC29BF568DEFC9752710182BFD81C2267EAE48DD193A0

Function 00A90B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A90B23

Strings

AutoIt, xrefs: 00A90B17
Error allocating memory., xrefs: 00A90B1C

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: c080ec047c5bee902e7d204febfec8dd740e2d0532258e5a5508e81eca3ce779
Instruction ID: 943772ab3728bbe2c81310d00f90fa95b0762f6557c32d91e57f14614959a601
Opcode Fuzzy Hash: c080ec047c5bee902e7d204febfec8dd740e2d0532258e5a5508e81eca3ce779
Instruction Fuzzy Hash: F6E0DF322883083AD21437947E03FCA7A849F09B65F10082AFB8C958C38AE224A006A9

Function 00A50D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A4F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00A50D71,?,?,?,00A3100A), ref: 00A4F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00A3100A), ref: 00A50D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00A3100A), ref: 00A50D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A50D7F

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 3d68b12863cf6f1601348f06c3e665b68224a07c973ec2d5fb389911b4105841
Instruction ID: ec3448f250c2a382e3791b3ca0e2fa9b32757f75759cd7a1c9623ce39a321e7a
Opcode Fuzzy Hash: 3d68b12863cf6f1601348f06c3e665b68224a07c973ec2d5fb389911b4105841
Instruction Fuzzy Hash: A6E039B52003418FD320AFACD504B82BBE1BB00741F054D2DE886C6651EBB4E4498B91

Function 00AA3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00AA302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00AA3044

Strings

aut, xrefs: 00AA3038

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 856d1227d67281fee2439af246e85cf096b2c95cda498d56eef8d6a4ec13873b
Instruction ID: e7127f066763912d0022328e1a5c35b023767a87a8625b8237d13dabb0cc1bcb
Opcode Fuzzy Hash: 856d1227d67281fee2439af246e85cf096b2c95cda498d56eef8d6a4ec13873b
Instruction Fuzzy Hash: 8FD05E7250032877DA20F7E4AC0EFDB3A7CDB04760F0006A1B659E2091DEB09985CAD0

Function 00A8D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A8D220

Strings

%.3d, xrefs: 00A8D22B
X64, xrefs: 00A8D2A8

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: ec69f34376133ab98aca1603ab763a497b8330d4663c0a4ba7cc6fc457f71d8a
Instruction ID: 90cc194c6db39524c72d022a24f52deb2d72cd50006211cf61b53a6c822b81fc
Opcode Fuzzy Hash: ec69f34376133ab98aca1603ab763a497b8330d4663c0a4ba7cc6fc457f71d8a
Instruction Fuzzy Hash: 03D012B5808108F9CB50B7D0DC49CF9B37CFB48301F508452F90692080F624C5096761

Function 00AC2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AC232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00AC233F

Part of subcall function 00A9E97B: Sleep.KERNELBASE ref: 00A9E9F3

Strings

Shell_TrayWnd, xrefs: 00AC2325

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 370f45b234c046c57fb993c084939b9dbf53c4f4044ebc6bbee2115d0066dd6e
Instruction ID: d61a7e79e6f9404ba9f710627c75d964a4733e09933856a7e670e0e7d2447b88
Opcode Fuzzy Hash: 370f45b234c046c57fb993c084939b9dbf53c4f4044ebc6bbee2115d0066dd6e
Instruction Fuzzy Hash: 5AD022327C0300B7E664F3B0DC0FFC6BA04AB00B20F010906B30AEA0D0C8F8A802CB00

Function 00AC2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AC236C
PostMessageW.USER32(00000000), ref: 00AC2373

Part of subcall function 00A9E97B: Sleep.KERNELBASE ref: 00A9E9F3

Strings

Shell_TrayWnd, xrefs: 00AC2365

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 985f4aeac5c98193a7e6c98f4220321b1f45a831a52be93498fe9925c2b46355
Instruction ID: 6d1f4b48dce91def9c62d8b470b6bd81247736cc0f1e3b92f18e9ce3ab5cfb64
Opcode Fuzzy Hash: 985f4aeac5c98193a7e6c98f4220321b1f45a831a52be93498fe9925c2b46355
Instruction Fuzzy Hash: 4CD0C9327C13147AE664F7B19D0FFC6A654AB04B24F014916B75AEA1D1C9A8A8028A54

Function 00A6BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00A6BE93
GetLastError.KERNEL32 ref: 00A6BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A6BEFC

Memory Dump Source

Source File: 00000000.00000002.2900783118.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2900764574.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000ACC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900849824.0000000000AF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900900774.0000000000AFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900920923.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 36793534ab7aba687a81dd0cab8f6f4dd9bc8240a36f0a069061bd567197db5f
Instruction ID: f19093bb1b1da9694b11f64f6023f2f801507180092b39036296cb079beff827
Opcode Fuzzy Hash: 36793534ab7aba687a81dd0cab8f6f4dd9bc8240a36f0a069061bd567197db5f
Instruction Fuzzy Hash: 7441D435610206AFCF21CFA5CD54AAABBB5AF41320F154169F959DB1B1DB31CD81CB70

Source: Joe Sandbox View	IP Address: 23.55.235.170 23.55.235.170
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725694757&P2=404&P3=2&P4=M0gElKNWcBASY068rVJB8BnSOBDhdMxs0Arm9S6MNrX2UnvMNIayRpTyCp9c%2bO6gKEBR%2fwhqGXsUUVQLcah5RA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: AfgiowHY10PnXpMAv3HjwOSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7cR8+8WSEcYUTgb&MD=tTGXV443 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725694757&P2=404&P3=2&P4=M0gElKNWcBASY068rVJB8BnSOBDhdMxs0Arm9S6MNrX2UnvMNIayRpTyCp9c%2bO6gKEBR%2fwhqGXsUUVQLcah5RA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: AfgiowHY10PnXpMAv3HjwOSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7cR8+8WSEcYUTgb&MD=tTGXV443 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.174

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\06834a8f-56d9-49f4-b2ec-ff37b7bc3b54.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2d83b2a4-1502-4278-aea1-a49d14a2667a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\30839638-9e16-494c-a3ac-118d59f3f82c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\39f62be3-9e5e-4987-a312-a7a330447fe6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\56f494d8-22d8-465a-8efb-93d64f9bfb51.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6bd10108-e7c4-4b86-afb4-bf01cbbfe04a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6d42c5c4-0192-4a9e-a53f-be4a74eb420c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\76da82d1-c9f3-403a-84e7-ae45d2d8b399.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\696e5b3b-3dfa-4dfe-b0ee-38ba5abcf67c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D2C88E-1BAC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D2C88E-808.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\03381532-7c83-4e05-a2a2-86f9ea63e7df.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\05a19891-82b5-4ba4-a560-9ea009670377.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre