Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502367
MD5:	d6f5bca2f2ce2407ae4bf9115cfca6d9
SHA1:	9bf709a5fb7d18fb70f15fab8aeb352b0d7b9aaf
SHA256:	33955cbc4fdce5f71691408a1431b76b8fd40cdfde91f8ea3724dc7414885c15
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D6F5BCA2F2CE2407AE4BF9115CFCA6D9)

msedge.exe (PID: 6776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,5833191931031966787,11974390165004238764,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7640 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2804 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4388 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 7644 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 1260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8300 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2084,i,16719056843521875255,13518431660041794610,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2092,i,17085435103752643681,17795961976953740855,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2088,i,17697685816420570348,13963450996301655899,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 2342Content-Type: text/htmlDate: Sat, 31 Aug 2024 23:28:02 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.d398d817.1725146882.42879083Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: file.exe, 00000000.00000002.2897532829.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2897532829.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: be68c1a9-1f32-4ae4-a8e1-ec15092f8b99.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: be68c1a9-1f32-4ae4-a8e1-ec15092f8b99.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2897511351.00000000013C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: be68c1a9-1f32-4ae4-a8e1-ec15092f8b99.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49797 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0021EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0021ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0021EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0020AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00239576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00239576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1646517643.0000000000262000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a5a87c21-b
Source: file.exe, 00000000.00000000.1646517643.0000000000262000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_441ff982-1
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b1d817a9-9
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_580e9d53-9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0020D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00201201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00201201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0020E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00212046	0_2_00212046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A8060	0_2_001A8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00208298	0_2_00208298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DE4FF	0_2_001DE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D676B	0_2_001D676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00234873	0_2_00234873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CCAA0	0_2_001CCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001ACAF0	0_2_001ACAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BCC39	0_2_001BCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D6DD9	0_2_001D6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BB119	0_2_001BB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A91C0	0_2_001A91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1394	0_2_001C1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1706	0_2_001C1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C781B	0_2_001C781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A7920	0_2_001A7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B997D	0_2_001B997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C19B0	0_2_001C19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C7A4A	0_2_001C7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1C77	0_2_001C1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C7CA7	0_2_001C7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022BE44	0_2_0022BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D9EEE	0_2_001D9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1F32	0_2_001C1F32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001ABF40	0_2_001ABF40

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001BF9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001C0A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@96/521@22/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002137B5 GetLastError,FormatMessageW,

0_2_002137B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002010BF AdjustTokenPrivileges,CloseHandle,		0_2_002010BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_002016C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_002151CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0022A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0022A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0021648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_001A42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\f8f892f3-292e-4d71-9925-6b604d7bcb8e.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,5833191931031966787,11974390165004238764,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7640 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2804 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4388 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2084,i,16719056843521875255,13518431660041794610,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2092,i,17085435103752643681,17795961976953740855,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2088,i,17697685816420570348,13963450996301655899,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,5833191931031966787,11974390165004238764,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7640 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2804 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4388 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2084,i,16719056843521875255,13518431660041794610,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2092,i,17085435103752643681,17795961976953740855,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2088,i,17697685816420570348,13963450996301655899,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C0A76 push ecx; ret

0_2_001C0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_001BF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00231C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00231C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97807

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6209

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.0 %

Source: C:\Users\user\Desktop\file.exe TID: 6748

Thread sleep time: -62090s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6209 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0020DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002168EE FindFirstFileW,FindClose,	0_2_002168EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0021698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0020D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0020D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00219642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00219642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0021979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00219B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00219B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00215C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00215C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96627

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021EAA2 BlockInput,

0_2_0021EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001D2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C4CE8 mov eax, dword ptr fs:[00000030h]

0_2_001C4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00200B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00200B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001D2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001C083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C09D5 SetUnhandledExceptionFilter,	0_2_001C09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001C0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00201201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_001E2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001BF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_001BF98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_002222DA

Source: C:\Users\user\Desktop\file.exe

0_2_00200B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00201663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00201663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C0698 cpuid

0_2_001C0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00218195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00218195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001FD27A GetUserNameW,

0_2_001FD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001DBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_001DBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00221204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00221204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00221806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00221806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
s-part-0029.t-0009.t-msedge.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://msn.com	0%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.186.161	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
s-part-0029.t-0009.t-msedge.net	13.107.246.57	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	be68c1a9-1f32-4ae4-a8e1-ec15092f8b99.tmp.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2897511351.00000000013C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.57	s-part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.250.176.206	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.81.238	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.100	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502367
Start date and time:	2024-09-01 01:25:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@96/521@22/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 13.107.21.239, 204.79.197.239, 108.177.15.84, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.217.16.195, 142.250.185.195, 2.23.209.182, 2.23.209.130, 2.23.209.133, 2.23.209.149, 2.23.209.187, 20.223.36.55, 43.152.29.78, 192.229.221.95, 172.217.23.110, 142.250.185.138, 142.250.186.138, 216.58.212.170, 142.250.186.170, 142.250.184.202, 172.217.16.202, 142.250.186.42, 142.250.186.106, 216.58.206.42, 216.58.212.138, 142.250.74.202, 142.250.185.106, 172.217.18.10, 142.250.185.74, 172.217.18.106, 216.58.206.74, 142.250.80.67, 142.251.32.99, 142.250.80.99, 142.251.35.163, 142.251.40.163, 142.250.65.227
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:26:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
00:26:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
00:26:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
00:26:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	HDKuOe.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
13.107.246.57	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1lNDkwZjQyMi03YTgzLTQxZGUtOTA0My00NzMwNDhhZDBiOTUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
s-part-0032.t-0009.t-msedge.net	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://multicoinsystemnode.firebaseapp.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
s-part-0029.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT1lNDkwZjQyMi03YTgzLTQxZGUtOTA0My00NzMwNDhhZDBiOTUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l	Get hash	malicious	Unknown	Browse	13.107.246.57
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://att-108937.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-100127.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-104325.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://bt-107258.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://juno-102941.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
CLOUDFLARENETUS	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.41
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	172.67.132.127
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.137
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	172.64.155.119
	http://scratch-netflix.ng-2ff.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.21.22.130
	https://hemanth-kumar-p.github.io/E-comm	Get hash	malicious	HTMLPhisher	Browse	172.67.75.130
	https://multicoinsystemnode.firebaseapp.com/	Get hash	malicious	Unknown	Browse	172.64.150.248
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://att-108937.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-100127.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-104325.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://bt-107258.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://juno-102941.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
EDGECASTUS	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	http://www.chacararecantodosol.com.br/wp-admin/js/milissa/swisssa2024/swisscom/index2.php	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	http://scratch-netflix.ng-2ff.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	https://www.askozvar.sk/wp-admin/maint/particuliers-sg.fricd-cboindex-authsec/rxSzWTx3TRsj1O5MghLJkjMYFPXGW2q1BLTysxQ4c0GKxZ45arKQynx/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.575493997072944
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afQDG8XrYOkHB+EzdrxfvBsVnkRmOadyaJkXwccwlRvrB0:Xq8NkC1fQDH8xBZ1vmirad7JkAchDq
MD5:	74E40E26C6F58DFED31E000352018FF2
SHA1:	A82831548335025DBF0675954128EBA939D3E61C
SHA-256:	F62BE8B9FA1717F19D28EA5085A4FB21597B21601EDF68716882D88506DDBA1E
SHA-512:	742E1F21BB7E72D1852B85192491D37F517D153453E28D613B0B69E87746924820AF4889B5305EE0F4A13EB98570EB7E7FBB63511F0D3D155EDFCF81AC580F9E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"policy":{"last_statistics_update":"13369620356518562"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0a6597e2-ad1e-42f3-b73f-d9ff0b9f4570.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70987
Entropy (8bit):	6.07440174562148
Encrypted:	false
SSDEEP:	1536:MMGQ5XMBGzfROipqij4CEy/sWTDvI0FgGVS3lT8eo+Ew6qRily11bR:MMrJM8zfROiEiECEQTLDejT86eqRIy1n
MD5:	DEC05EA6E23C8BF8C650036CF50F0C37
SHA1:	0E969A01EA82B853F9920F8FB7E5FA70E3A43F85
SHA-256:	919C0A96551689020444DD323E7077E75E6422B04C8704EDB41F5CACE6D63C68
SHA-512:	5887480553EBEC26C4A17889DFA67D32A14F61C3B449664B60EAD32C6E4ABF50FE10888835F09CC50FDBFCD7A47DC7F6299D8049A56879D024FC81BB485C290A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0b0453c1-db7a-45c6-bc86-7136e413c374.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70948
Entropy (8bit):	6.074328398204719
Encrypted:	false
SSDEEP:	1536:MMGQ5XMBGgfROipqij4CEy/sWTDvI0FgGVS3lT8eo+Ew6qRily11bR:MMrJM8gfROiEiECEQTLDejT86eqRIy1n
MD5:	70A0B97C5210E7E04E7C7308C83FAF8D
SHA1:	2E02B6AAA421DA88849A28DFE9182716D5275701
SHA-256:	B4281985E3F35DE570633BC7A855E4E221AF8D7A051DB4E0D7FDFB74C810D439
SHA-512:	AC70B86621F02E18EC657C64FD5E33B43F5A70098E4F2C874F79DD1B81C326BACB080EB4F560CBB9EEA9E6443AC061C1EF227AA8BF727C6A276AAE46BD82320F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1f37626a-f07a-458f-b924-cf59f423cdd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\24f73c25-2e79-4f29-aa68-fd82f0d82252.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24342
Entropy (8bit):	6.054889803368532
Encrypted:	false
SSDEEP:	384:MtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NG3al5zfqdqVEuyQyV1PdQYT3W4Ad4nR:MMGQ7FCYXGIgtDAWtJ4npazMbQyV119n
MD5:	C9A50DD7D226B321E59F12725B85F312
SHA1:	89C93E0DB69232DC7925E45485690CF17B4750AB
SHA-256:	1F8A28111E1D2B696758948A98612886F8F28409F4F0C17E6D2DEC400A22C3BD
SHA-512:	9B478685CD0A2DD8A187DB4DE9722B717E022D2870DD5DF56EC6CF44DDAF4D1AC9AFDB80757BED8CE8C818020DBFCDA3C16EEE1BFF62D05A88BF5FC599C583F0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\27bd07da-2e66-42a1-bad9-f64bb25ad9c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064999646215805
Encrypted:	false
SSDEEP:	384:MtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS3al5tuAvV1PdQYT3W4Ad4nR:MMGQ7FCYXGIgtDAWtJ4nbatuAvV119WS
MD5:	A750E2AEA4668E5F712924FA6EB6A9D4
SHA1:	501DCCDAD516871B2F5C6E03203F03BF41BD3B2E
SHA-256:	6B6C8C972F591322798A417CD6FCFE297D5AD9699759610179C8EF6CEA16366B
SHA-512:	E73395380C700E72011E54BF155760DF3FC504121290645CA8709272F03DCFAF207EE2780153DF41A4290239A4A80D87746EE8920DE3470D28179AB5A0E4A126
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3814454f-a4ba-41e0-8968-dada57e15464.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064989926770694
Encrypted:	false
SSDEEP:	384:MtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS3ai5tuAvV1PdQYT3W4Ad4nR:MMGQ7FCYXGIgtDAWtJ4nbXtuAvV119WS
MD5:	44EB985DE6F033D9B828CB23EEDBD27E
SHA1:	E94C9E818D4ED2ADDC2AAABBFFB5C6E23B8DE0D2
SHA-256:	E8D7F76A0190312B396FCE6D53D7FFB03225A24145FFE95FEC7C3906C0E10AE5
SHA-512:	639D2BA873BEB15C010ADDE3DA8F017EFB80DBBE9555AFB5DCC3F4303115F2C22A4745C99077250A4515A0511E4C31B4CD971404FA5228DA4FB65F056D3E5F1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\90b74960-7372-4ff6-ab24-72327f1d437b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064998095223441
Encrypted:	false
SSDEEP:	384:MtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS3af5tuAvV1PdQYT3W4Ad4nR:MMGQ7FCYXGIgtDAWtJ4nbItuAvV119WS
MD5:	3740F19636986CAC4402CF4699D59D48
SHA1:	CD83D95D6823233BCA2DDAD7348CC2D35EF2151D
SHA-256:	1F8A03668901A8EE9DE0EB00E625DA192B8B4CABA46886494FAB09FD3FF35FE7
SHA-512:	A0143AF2DEDA01D5EFE91E3360E40B518437B1BB9BE8F006A3B076C93F2CCDF65FA28EBEE6FA2F4302ED37A636A7B8A62285AD332D6EAB1337124E86CCF2A369
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\12a967e4-750f-4e1a-b9a3-05243902c9d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A684-158.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45717998843347607
Encrypted:	false
SSDEEP:	3072:R6tbG/WLzpQQMJcdw4J7D9k9SjfOdyYDIvUqK5g1HF8gQocz+QOpeVqw3U93fXAY:EEWHOZqK5aHe3JYfRLfaHFwZM2
MD5:	A553BA5939757E0F5E634653D6FE89D3
SHA1:	B67B2FFE204D4280F73252622222AE407680F539
SHA-256:	02B4DF890A49F60511380582F8A85278FE072C76383F0FEFCE872161F6D57AF2
SHA-512:	2C0E2EADD433AD389855F34B7F835570B8D26B0BAFE09E97DDFF84D6B8E31109E554755A7BA2D5F7B88412E18F5780F7605527A8CCEEF174728DA109C91084FB
Malicious:	false
Preview:	...@..@...@.....C.].....@............... W...V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".nenkrs20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A684-1A78.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049268064680348
Encrypted:	false
SSDEEP:	192:mAUjLYiVWK+ggCdlQJtD+FX9XnokgV8vYhXxNEq4bcRQM9XiHn8y08Tcm2RGOdB:lUjjlcqanhBCQFiH08T2RGOD
MD5:	B89FB58916679A3D8CDD5EFB1D0BFED9
SHA1:	B5E1CC78B7119CC73F2A42026B67DB4FAA22D3BC
SHA-256:	CDCAC217D2AFFFD8609AAC784F60D7F22E37F79AFEC01AE32E7C519EAA0FD6A0
SHA-512:	A46E25527CD5E165D32056416BA5800F5DDCA342E26F9D5988C65F7EF8B1BA35850BF62D8626D195E71F9914D9ECB10C247620842834A40B869A9E4398E7CDA6
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".nenkrs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...................................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...^.I...U@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.151961087961952
Encrypted:	false
SSDEEP:	3:FiWWltlPM8OlAIHSRqOFhJXI2EyBl+BVP/Sh/Jzv5UQf1XgruAVasltl:o1E86XyRqsx+BVsJDt1XgrP0slX
MD5:	0D5728A234DCA00ED44C69617A6D507E
SHA1:	37F3EDC8DE6C086BAD867EDC5FB906B39922A660
SHA-256:	095E48D798AEE8AEA31CE27964E28965D5A25DAD0E0947694F46841D4A971558
SHA-512:	DA67A6C8E952BB5CA519E0BA6A6FA1F71B06C19649887DE89E085C11DF46B7632663BCF086D4B36AC0713CAB77206C65BD4DAC547DB8A8F9C1E23A92F764818B
Malicious:	false
Preview:	sdPC.....................`..OR@C.w.]...."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................06190dea-de1c-412b-80d5-8ce5e0bda8df............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\16913a56-e754-4ef9-bebc-a66e7a1e0148.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\182ff923-bd10-4faf-852c-4f7fe450e0b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3968e333-5b4e-4179-a135-15ae8be7acb4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.975196889714007
Encrypted:	false
SSDEEP:	96:stoqftis1rb9AB/N8zYDts85eh6Cb7/x+6MhmuecmAedwOZn2MF/EJ:stozss/NkGs88bV+FiAEPFMJ
MD5:	BDA2FEC978FFB0A6DAB719276B55BBD2
SHA1:	65C4C97B48B5E55D4FB595A73B94CB9CAE2B8E92
SHA-256:	3530C25FF14FA6578BEFF441861A4D6CAF79A3FDAF5DF6C79C80E0C1AF16D00A
SHA-512:	A327EF1D55E8BA74D2D28C931DE64103AA7A739211CB88C014B7DE9FB6BDACFB377583F95B5CBA1E6AC619B3E81A9C52DBAF82F0CB74EFB25B664A2832509F2C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620358945846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620358947603"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\465eff51-4817-42b5-8986-9341fe67f8f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566199442110588
Encrypted:	false
SSDEEP:	768:kjeK+NWP9Vf838F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFlKtA3rwNMpGtuA:kjeK+NWP9Vf83u1jaB/k7N1tT
MD5:	7892CC2EBC3D455F75C322431165F453
SHA1:	29D95B4280E9E059AAF5DD3B697220ED8BD721BE
SHA-256:	93A37E405AA43E7C778376678A000D92A7AA11AFB71DA5515201D8CE30AC117A
SHA-512:	FECC8750F5BDEC6D3FBEEBE7105121C5C42A64DF8EA1A0A21093123BFC6D07489A289995AD70C3592CBB6B1213F5910E2532BB6FBB3146445719109FFC1DA296
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620357115874","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620357115874","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\98e7dfa7-ce0c-4cdb-91e6-02ddbf071816.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	4.984217281038732
Encrypted:	false
SSDEEP:	96:stoqftis1rb9AB/N8zYDts85eh6Cb7/x+6MhmuecmAedLoQBn2MF/EJ:stozss/NkGs88bV+FiAe/PFMJ
MD5:	4F5547BCC6C3A1410B8E1AC63E089D9F
SHA1:	DC1C8348D6ECEC0FA4157368A5350363975F19D5
SHA-256:	A7EDF96A91F042EB4436603DAF513C9338A1EBC37918059AE46999C845CFD88A
SHA-512:	D1D69FD9A965BA5446C4F463F21CAE15169BC5C63957A338F9EABFCDA343C15C0632BAED1FEA626D14FE576E50B344788B2743FD100BA0FB0CF001AFD4FDB82C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620358945846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620358947603"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3202830916667345
Encrypted:	false
SSDEEP:	192:qAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:9OEOKSXs/J7mGnQmLu5/5eNdl
MD5:	FB0DFE17210896818CA40C8AC2715A04
SHA1:	0CBE4DA2E7944C685097840ADD48DB753669CA91
SHA-256:	DA0A10DEC2A0DD66D2FE8A70CC0E37D753764994408D36DA6AF72B49E6BFA32E
SHA-512:	B4B6F1CA94BA3A9F073467694AFFE54CDD548CB3341FD88483B9CF58F2817E2D8AE65F25E07BFDE32D2A4FBEA30F9E0E12F0CDDDD2522B56F42C085F5200F554
Malicious:	false
Preview:	...m.................DB_VERSION.1.O.R.................QUERY_TIMESTAMP:arbitration_priority_list4...13369620362388872.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.143194669476451
Encrypted:	false
SSDEEP:	6:Wk1wkn23oH+TcwtOEh1ZB2KLlsHlL+q2Pwkn23oH+TcwtOEh1tIFUv:WTfYebOEh1ZFL7vYfYebOEh16FUv
MD5:	1E41BE28B8135EA2B3F4DEC796134562
SHA1:	D22A80187C9C2290F8D082D7F745784AB86E187E
SHA-256:	1C456B5F6AAE345A75CF8F02D9DE845372F2BF52B5F3871FE6900B631B3DBE1F
SHA-512:	E7B2ED30A37C64347F6ED3A2BE6388516ED8F4EF2AE08F450FF114A86DC7C86641F5D17D02D5892419407710AEED41BAA1E4FA4C2DB9E5730B37CB5ED44A2392
Malicious:	false
Preview:	2024/08/31-19:26:02.191 2198 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-19:26:02.279 2198 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04414052676699188
Encrypted:	false
SSDEEP:	6:/Fii24eXOkM/lbIc+x/az1MtbV8T1GkllTXi/l2:d1CEk3xCEu/r22
MD5:	FC7E5C254F62C9B40E9670154FF8B6E3
SHA1:	9FF7F785E784F298FAC85C25DEA445EEC63B908A
SHA-256:	720DBA45109A891FA47BE840E3BDCEFC795639C0910B1A1ACA3304CA4382FB96
SHA-512:	0167BD12A73280982068B3333DD872D644013D21EEEBD353694DE4F0721EB8C6D092A34671783FE38028D987E1FE88F85464D83EC1A430FDA5081E94C79A842C
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09568699505436558
Encrypted:	false
SSDEEP:	24:RrcV4XQ3eaPVHX/NV4XeaPVHaUAPnQzLIoMaQQzRHVIRBNUeGby1lelYT38EWp46:KV4A3esXVV4XesrAaf6NUeGwT3lWp4
MD5:	1EFAB26B3D3CA3A44E9E9FCCBE8D35A5
SHA1:	665F24EBFAEAA6B3DE6E5D76660E36891631F1C4
SHA-256:	8295F74630569C6A62D4DB912D1CE1E468E3149B19032B9D390BA91DE501D250
SHA-512:	3CBBF2947D34AC93F865C04F77B13C3AC7B0B5BC9B1418849B05EAEAEF304386015D3995B9C9DC72D0E0641852897E13AE1455E0D4CC0E9C6FB05D52D2FC3648
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28323472651369364
Encrypted:	false
SSDEEP:	192:g3zrhFcJZbtMXUzrhFcJZbtMXCArc/JZbtM6lrc/JZbtM6R7pr9PD7JZbtMzUUV:g3sJtMUsJtMCpJtd2JtdR7hJtk
MD5:	B1848AEA57883A6FCAA1D14D777E6A8E
SHA1:	6C9E4B717F05763C6A236DB63D8364C623DF4ED0
SHA-256:	E716A2966F421E5CC2FB20DB38B50298685E8CB0E1B8D29884D03BE9A548BE9F
SHA-512:	463A2968E10CDB945EF06D0856E4EFF8AAC289941E01806A560FB8DA54747D0C8E2D9DDC18494A1BBA905006C376C7C431D8B5B999BF8FDE964BB8A5BB8EB1EC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsuly2p:Lsp2p
MD5:	B544497ADD229E7B62721420DECC409F
SHA1:	A25CC1180223799A89AD0CE3D62E6931C9B4C2FC
SHA-256:	ABE9252E742BC8480431965D085A5223C50E626E7694927C21FF64C0B4982BB3
SHA-512:	307CA0ABC24EFE80BC14172ADEC9DBB44B215DF65C75E0C926D29C8CBF5D18420CBDFD3E0054C23990E6908BF595489B3AD5A7CB5C992BCF8D9211C6E77F828C
Malicious:	false
Preview:	..........................................EP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Eskt00EwBUa+n:Ee0UT
MD5:	F1F3F561D693E1D64B29059B4E3A9B5F
SHA1:	B4745181FEF154FABF02A04667E5BE947C94DC2D
SHA-256:	F1B6A0729E7BEBCF8A7A9B93D4AB31ECBD2FC7D7E90A7034A4A69CBEB7B1E1C7
SHA-512:	EDA10CAB599B5346DD6292EF2A895C312AB58BD6D4BDB929DCF94559B45299B4F84123F3075021EF0422464D0E9417F675763E28E74876142CD213DA0F9A33C2
Malicious:	false
Preview:	(...YIi.oy retne.........................$0P../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Eskt00EwBUa+n:Ee0UT
MD5:	F1F3F561D693E1D64B29059B4E3A9B5F
SHA1:	B4745181FEF154FABF02A04667E5BE947C94DC2D
SHA-256:	F1B6A0729E7BEBCF8A7A9B93D4AB31ECBD2FC7D7E90A7034A4A69CBEB7B1E1C7
SHA-512:	EDA10CAB599B5346DD6292EF2A895C312AB58BD6D4BDB929DCF94559B45299B4F84123F3075021EF0422464D0E9417F675763E28E74876142CD213DA0F9A33C2
Malicious:	false
Preview:	(...YIi.oy retne.........................$0P../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:h+AdEluI4:8AKlux
MD5:	BFE19C308A59271972356AE250DC3618
SHA1:	6691141E3285A09A794A6215C689A3E96FC5B068
SHA-256:	7569A01A766E1E5A9B3F87DCB86FF0F8B9A412C13FE6268D8FE9D90BD07878C7
SHA-512:	70894DD2B68BA8A0C7E340582DFDDA301BBC4F3B2A7533E76B0E7D151298908EADEC38E2335F505E2E31BBE2F3EFF3FE5CAE1ACA0449F8F376B3ED9880B35B0A
Malicious:	false
Preview:	(.......oy retne........................9.-P../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:h+AdEluI4:8AKlux
MD5:	BFE19C308A59271972356AE250DC3618
SHA1:	6691141E3285A09A794A6215C689A3E96FC5B068
SHA-256:	7569A01A766E1E5A9B3F87DCB86FF0F8B9A412C13FE6268D8FE9D90BD07878C7
SHA-512:	70894DD2B68BA8A0C7E340582DFDDA301BBC4F3B2A7533E76B0E7D151298908EADEC38E2335F505E2E31BBE2F3EFF3FE5CAE1ACA0449F8F376B3ED9880B35B0A
Malicious:	false
Preview:	(.......oy retne........................9.-P../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQt1a:Ls3QH
MD5:	95AA884E8A5D14E4CC45A5F17EE720E3
SHA1:	347E0CD75083D14BDF7E2D2C970E3D802DA51BF2
SHA-256:	3DF4C41F946888A7E6F2F9FE2F423186C8F0516682E0C29CD3EB50B0C7511A97
SHA-512:	52ABC2039566E11D11AABDF5B20FF18A19E760A9AA64459A64C09D344B9F4A06D41F8AD11509A0C5FDF84C4D08910E363F2391699A08A1744E1E59144A549B1F
Malicious:	false
Preview:	..........................................HP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354070624784014
Encrypted:	false
SSDEEP:	6144:gA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:gFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	F5EE40069959D52E1ADCB264E874AAF1
SHA1:	8E1D1838CABA6F4526A8AAF6D4ED36D517BFE935
SHA-256:	AA25C2DDD02F6A953CB6A51304323A94D8C08A6E0A114BC6544DC3D65EE656B6
SHA-512:	9A976E4CA5BA5E6AD964550759B8B0A1479D0A8F60362C6B4092965205EE45969E2776C450977985A82DDF8136AC589DA17D61B49292DFB9896AF0ADF83EC28A
Malicious:	false
Preview:	...m.................DB_VERSION.1?\..q...............&QUERY_TIMESTAMP:domains_config_gz2...13369620363073835..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.210996357628578
Encrypted:	false
SSDEEP:	6:ZFKM1wkn23oH+Tcwtj2WwnvB2KLlB34q2Pwkn23oH+Tcwtj2WwnvIFUv:2rfYebjxwnvFLD34vYfYebjxwnQFUv
MD5:	925E2A97055395B14C42908EE173E421
SHA1:	0414577296AAFBA9009A3DCB7E4C3A17CE529980
SHA-256:	701FF68FF0B98687664D73D60EEF8565AAA61617681EE999CDD7CE4657D0D197
SHA-512:	6ACAB043976C6EE148BDE6DE5A8DD1C4EF0BCB16DB2CDF5965BA38A017CF31E6E8901495DC1C1D87928CA0940D380C324D089E9C05D997775E38E533CD4FF5B4
Malicious:	false
Preview:	2024/08/31-19:26:02.247 21c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-19:26:02.324 21c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324617305941167
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvF
MD5:	9E7F1B6BC5398FF7B017C5ECED2FE55F
SHA1:	BD7CC74BF9E77EF45DC17990A319595518AE1DC5
SHA-256:	0E2F3749A621EAC47BAC2771E14F79EEA35A3086592187AC892EA87EFA00DCDD
SHA-512:	7DF53CB5245985E89721BAED00405641F58351CF2A6A72FBCFC735D3957A7470FABF3D978DC7AE6923CF55BE6AB95AB1F02F88B174001176F29A03037B85F580
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.231262657375967
Encrypted:	false
SSDEEP:	6:mgs1wkn23oH+TcwttaVdg2KLlAAq2Pwkn23oH+TcwttaPrqIFUv:lfYebDLbvYfYeb83FUv
MD5:	1BF97F1E02BA1D4045DE85309A143670
SHA1:	F0944E60582469564A583D450FDF3862B70298A5
SHA-256:	6AF18B5C3989D6CACCBA3D03C766B39C6535C6F87A79570990E8530B36E116E5
SHA-512:	54F5E3786FDB38D945DC16D47754968E0F311E92075ADA741DBA6F962A15A44AECBB866E4B930B77547296DBD573B1F27F54A93358BBE32D323AB56C489DB7C7
Malicious:	false
Preview:	2024/08/31-19:25:57.116 1d00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-19:25:57.691 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.223680734494206
Encrypted:	false
SSDEEP:	6:B/ms1wkn23oH+Tcwtt6FB2KLlTmq2Pwkn23oH+Tcwtt65IFUv:p0fYeb8FFLMvYfYeb8WFUv
MD5:	BDC120A8B2222BA66DE2C223EA8D1962
SHA1:	A6D8356A57C4FE7D49D37D12C4987E7B290A17B1
SHA-256:	82B0A193678891478BE365C5F99066198CD11E869138D2FAB4472D9BCBD4AE59
SHA-512:	DC2269677D83EADEDDF14C5C04AD48C0D7D9B85B66CF1BC1C19DA9AE262ECA956CD1B7A95E9CA58F9275269CFB9CE3E7979179C10877F80678DA6A8E42299B3D
Malicious:	false
Preview:	2024/08/31-19:25:57.698 1d00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-19:25:57.812 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.190420409386887
Encrypted:	false
SSDEEP:	6:SFD1wkn23oH+TcwttYg2KLlGF0HlL+q2Pwkn23oH+TcwttNIFUv:2yfYebJLk0HIvYfYeb0FUv
MD5:	21EE4EE70E12605853C673F1FF7BF836
SHA1:	82252128DF853CE12FB228B4166DE41F6BBC05F1
SHA-256:	77AD5606D8D6CE2D8ECA6EFA8CE80405FCBEA33E812C384F4D58754A92D7797E
SHA-512:	8BB5BA50245933A119FBC68897CA203DE29B3CA38F893F72F306E3961026C8D3B0767681FC8EF19FF2F918DB212B2E7648F10B858181875E69C678AA166074A5
Malicious:	false
Preview:	2024/08/31-19:25:59.521 1c98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-19:25:59.531 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlra:Ls3
MD5:	EFA1BE926657E006305D5E5281413DCD
SHA1:	3267A74A035C4C2600A00E0200FBD4E573344D41
SHA-256:	559F436CDAAD596CD885C8C163A6D119CEA39889BA7C6A39DF491AF62FEEF8BA
SHA-512:	C3CABC4D14C21BF575048FB896659F2ECF3A1330C6543864E6B7F4A3918B6A521C0700472A17E23B58C26A3E31A58AB9B2EB5684C742590B789654DD763D69DB
Malicious:	false
Preview:	........................................M_GP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:ltDl9tFlljq7A/mhWJFuQ3yy7IOWU9dnotdweytllrE9SFcTp4AGbNCV9RUI6:ltDk75fOTdnotd0Xi99pEYk
MD5:	1C7E23B142A166C5FB9588BF19E72117
SHA1:	CDAED28551845F1F426483C629DAC4DC17A091CD
SHA-256:	C070611816C620ECB25054A1D8D071EC034F87FACC54069E4556C918606756CF
SHA-512:	984F4A4DE1F9FDC5292344703F2F50A6692304CD61E32B2A70A6A5AD83DD8E1906AE9D6076FEA4BCFC8F4478EC1D950995283658E3A98F350139CECFDFB5FC7A
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.227032320183952
Encrypted:	false
SSDEEP:	6:HQvRq1wkn23oH+TcwtRage8Y55HEZzXELIx2KLl9wOq2Pwkn23oH+TcwtRage8YU:HQbfYebRrcHEZrEkVLcOvYfYebRrcHEz
MD5:	946C724ECD3E462C135A155E29FDCC63
SHA1:	F1B55107E14602355D7CC833AD70D5428FDB8DAC
SHA-256:	08726A2B0C14B8B0A1BA98C2181B749BFC426629A2C776C288A966B83D04D50A
SHA-512:	74FD86E0A944379A4F7F1E9DA6793770713E7DDC593EDED43532E151F995EA414B47B2D35DC03EF99F9E02DD8D5819580169DB4E66B1BD098A930DE70AAB49FD
Malicious:	false
Preview:	2024/08/31-19:26:00.095 1c90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-19:26:00.115 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.276201561576243
Encrypted:	false
SSDEEP:	6:sqCRM1wkn23oH+TcwtRa2jM8B2KLlXpUVq2Pwkn23oH+TcwtRa2jMGIFUv:sLRrfYebRjFLxmvYfYebREFUv
MD5:	10540F5180583B2219D5A1C4BAAF8C8B
SHA1:	D0D99882CAB80595F93C419F610C168D129B8951
SHA-256:	A6F7728675D6FBD910F7E4A78F2CD43125A28EB8CF688A924037F0982DBD55D9
SHA-512:	9FDA25DBB9FAC449A2B86D9BFFB62815B76A96B3FA2D90CF791C4E8D469D3D6C9AD1B4C91A4CC1FC6177F0A5CA99ADA381557CC9588D9BEB11B3F563FCA70531
Malicious:	false
Preview:	2024/08/31-19:25:58.479 1db4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-19:25:58.567 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\4216ff82-abc8-4e9f-945a-6bc5dff601d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\8fd2b0f4-8d69-424e-b8af-de8dd9f85925.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b47c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7601668806871047
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkab:uIEumQv8m1ccnvS6XlX
MD5:	9286D481E4761B8F0D5EA69B6A08AE6E
SHA1:	4B12C900EBAC335F591170D92AC4D03C19510843
SHA-256:	A20C269C83044D6A25250169256079EFC368208AADF16D2AE9DEEA396E6E652E
SHA-512:	20BD296BAE19C09FC31CD1525D244DB6412AAB88231F3BF42CC59D8618AE308A82C92B5ECDC880E6A6A78B2E522BA97CEE9C0AD43A11A00048CC5033159ED207
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2939b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a9e2c709-6898-4d97-be2e-17f252bff8b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\b57959e8-ea27-47d0-b8d2-b61332ab74c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\eb74e617-4c1b-4bac-a770-b0ef98afa83d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.975196889714007
Encrypted:	false
SSDEEP:	96:stoqftis1rb9AB/N8zYDts85eh6Cb7/x+6MhmuecmAedwOZn2MF/EJ:stozss/NkGs88bV+FiAEPFMJ
MD5:	BDA2FEC978FFB0A6DAB719276B55BBD2
SHA1:	65C4C97B48B5E55D4FB595A73B94CB9CAE2B8E92
SHA-256:	3530C25FF14FA6578BEFF441861A4D6CAF79A3FDAF5DF6C79C80E0C1AF16D00A
SHA-512:	A327EF1D55E8BA74D2D28C931DE64103AA7A739211CB88C014B7DE9FB6BDACFB377583F95B5CBA1E6AC619B3E81A9C52DBAF82F0CB74EFB25B664A2832509F2C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620358945846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620358947603"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32319.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.975196889714007
Encrypted:	false
SSDEEP:	96:stoqftis1rb9AB/N8zYDts85eh6Cb7/x+6MhmuecmAedwOZn2MF/EJ:stozss/NkGs88bV+FiAEPFMJ
MD5:	BDA2FEC978FFB0A6DAB719276B55BBD2
SHA1:	65C4C97B48B5E55D4FB595A73B94CB9CAE2B8E92
SHA-256:	3530C25FF14FA6578BEFF441861A4D6CAF79A3FDAF5DF6C79C80E0C1AF16D00A
SHA-512:	A327EF1D55E8BA74D2D28C931DE64103AA7A739211CB88C014B7DE9FB6BDACFB377583F95B5CBA1E6AC619B3E81A9C52DBAF82F0CB74EFB25B664A2832509F2C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620358945846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620358947603"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39859.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.975196889714007
Encrypted:	false
SSDEEP:	96:stoqftis1rb9AB/N8zYDts85eh6Cb7/x+6MhmuecmAedwOZn2MF/EJ:stozss/NkGs88bV+FiAEPFMJ
MD5:	BDA2FEC978FFB0A6DAB719276B55BBD2
SHA1:	65C4C97B48B5E55D4FB595A73B94CB9CAE2B8E92
SHA-256:	3530C25FF14FA6578BEFF441861A4D6CAF79A3FDAF5DF6C79C80E0C1AF16D00A
SHA-512:	A327EF1D55E8BA74D2D28C931DE64103AA7A739211CB88C014B7DE9FB6BDACFB377583F95B5CBA1E6AC619B3E81A9C52DBAF82F0CB74EFB25B664A2832509F2C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620358945846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620358947603"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566199442110588
Encrypted:	false
SSDEEP:	768:kjeK+NWP9Vf838F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFlKtA3rwNMpGtuA:kjeK+NWP9Vf83u1jaB/k7N1tT
MD5:	7892CC2EBC3D455F75C322431165F453
SHA1:	29D95B4280E9E059AAF5DD3B697220ED8BD721BE
SHA-256:	93A37E405AA43E7C778376678A000D92A7AA11AFB71DA5515201D8CE30AC117A
SHA-512:	FECC8750F5BDEC6D3FBEEBE7105121C5C42A64DF8EA1A0A21093123BFC6D07489A289995AD70C3592CBB6B1213F5910E2532BB6FBB3146445719109FFC1DA296
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620357115874","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620357115874","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f3eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566199442110588
Encrypted:	false
SSDEEP:	768:kjeK+NWP9Vf838F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFlKtA3rwNMpGtuA:kjeK+NWP9Vf83u1jaB/k7N1tT
MD5:	7892CC2EBC3D455F75C322431165F453
SHA1:	29D95B4280E9E059AAF5DD3B697220ED8BD721BE
SHA-256:	93A37E405AA43E7C778376678A000D92A7AA11AFB71DA5515201D8CE30AC117A
SHA-512:	FECC8750F5BDEC6D3FBEEBE7105121C5C42A64DF8EA1A0A21093123BFC6D07489A289995AD70C3592CBB6B1213F5910E2532BB6FBB3146445719109FFC1DA296
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620357115874","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620357115874","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.180757006891762
Encrypted:	false
SSDEEP:	6:HO81wkn23oH+TcwtSQM72KLlFMVq2Pwkn23oH+TcwtSQMxIFUv:ubfYeb0LMvYfYebrFUv
MD5:	AE83DBF84F577B2563DCE35D00EEC312
SHA1:	92DACFEF7774872BA2BD17A4F22457DB9933E087
SHA-256:	8B803CDAD589AF81DF608D6855448579B21C6518AB24812621828849AC0203BE
SHA-512:	9CB8566F2A7374E8A6FB086004D006867BA8D202C33003B318E05499941843E8EC4794B1908A042203C5982932088A4F82660520E4070B0E8B8DD9EE5BFF9565
Malicious:	false
Preview:	2024/08/31-19:26:14.958 1de0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-19:26:14.976 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.158172854445307
Encrypted:	false
SSDEEP:	6:sq1wkn23oH+TcwtgUh2gr52KLlwu+q2Pwkn23oH+TcwtgUh2ghZIFUv:MfYeb3hHJLGfvYfYeb3hHh2FUv
MD5:	5A9629DF6E773058187514C74554985E
SHA1:	29F1E4441C1B9FEF347767736B1C10C059312042
SHA-256:	0A3E1509309F91B65277C2B22C62F8405651E9B1352BBF09780D2808B760B49F
SHA-512:	D9FB7B6F932373C885DC05CB807D086E81002A4CBFC8BB3AA66C0AE6BCCFB28911094FF0698B3DF76AFB785FDEC57B956F03BE5C9A59D0EAF2E0002CD62F64BD
Malicious:	false
Preview:	2024/08/31-19:25:57.096 1cc8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-19:25:57.254 1cc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul:Ls
MD5:	94AAB6B2BDCD43D84FC3E3D7935F3EAB
SHA1:	6207EADFF747F4428523BDF2555479C042AE95F2
SHA-256:	B49513F9410C4AF9F261DBF1E1BF4328DCA96605973E2901EF53043E4D5C45DD
SHA-512:	AEBC91BE765C586B584EF0AB4799E5BFFF023CE00E02C1A07A02946A75B8270670663BDAFE346F2033D6E0BBA4EE24CAB986BFC9547BA79D8EF2042243328A8F
Malicious:	false
Preview:	.........................................P../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:o7QEAJel:o7rs6
MD5:	1984B0838C1CE1C4DA4C061B5FA5A83E
SHA1:	EEE51A77CEC3025E3A6C1972BA7F135E5184345E
SHA-256:	83B968EE35931D3394A4D07CA1A8C1A7A2045E4162E6680DBCB8846F042A496E
SHA-512:	B1841E0F1C8A3E7F0A6C499AC4F925F8C6BD2A6AC8D45FA60359A44B643BD961A099153B6E16AA10156DA312B5C100025B858828CF295148383E950AABD0F9D4
Malicious:	false
Preview:	(...5^..oy retne.........................,HP../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:o7QEAJel:o7rs6
MD5:	1984B0838C1CE1C4DA4C061B5FA5A83E
SHA1:	EEE51A77CEC3025E3A6C1972BA7F135E5184345E
SHA-256:	83B968EE35931D3394A4D07CA1A8C1A7A2045E4162E6680DBCB8846F042A496E
SHA-512:	B1841E0F1C8A3E7F0A6C499AC4F925F8C6BD2A6AC8D45FA60359A44B643BD961A099153B6E16AA10156DA312B5C100025B858828CF295148383E950AABD0F9D4
Malicious:	false
Preview:	(...5^..oy retne.........................,HP../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:q+ZHtAyEI5+ln:q0S9M+ln
MD5:	CC822518C4004B1FE18E49C3B15990C7
SHA1:	7931C20D43DBF006F9C6DD3C5210608CF9C8550E
SHA-256:	423B83AB1848168C8D6199D00E89A265A20A129EB88C7875655AAEC1EC7C49BD
SHA-512:	078177AF4CFE6361417DD604C2407BFE91F8A1F56CA335BA235914CC3A10B0F5CFA80618CBCBC3FDC1E47FB47CF75E22C79687BC594793BB38E5FFE1EEE48D92
Malicious:	false
Preview:	(.....I.oy retne..........................GP../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:q+ZHtAyEI5+ln:q0S9M+ln
MD5:	CC822518C4004B1FE18E49C3B15990C7
SHA1:	7931C20D43DBF006F9C6DD3C5210608CF9C8550E
SHA-256:	423B83AB1848168C8D6199D00E89A265A20A129EB88C7875655AAEC1EC7C49BD
SHA-512:	078177AF4CFE6361417DD604C2407BFE91F8A1F56CA335BA235914CC3A10B0F5CFA80618CBCBC3FDC1E47FB47CF75E22C79687BC594793BB38E5FFE1EEE48D92
Malicious:	false
Preview:	(.....I.oy retne..........................GP../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl22aa:Ls3Paa
MD5:	0AAC0EF02CD9BFB53DFC036651861D25
SHA1:	ADD41C16373C8466C7F17EA1F3D1FA5116165DF0
SHA-256:	90C652EEEA403907C82539DB65D65B71C5B421A935AD615B30A8B919A88D2CE1
SHA-512:	7434408574964D72EFD44B1B470A21EEE990E1C7969AAE0CE1C4F64E83A4487EFD53555588E21DC55F54ACCABFB7CA140D66F27D39EE1BE40722788B8E1A852B
Malicious:	false
Preview:	........................................#.PP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlxp:Ls3z
MD5:	02AC755C72CC3A16A40DACF2E3A6ACA1
SHA1:	B71D467B32F30202AEB4991A2D6E4DB7DFC564DD
SHA-256:	A33F3E431BB9E942C88A29CEA3727479FF14F03357A2DEFA043D0A9487BAE743
SHA-512:	A90B7ACD25B6CE383C985786CCEFD3D12B8B1050CEE6272365B8FF26FA95E4B5F6BD3C5A6D4D57A99CE011613C3DD70FC88B3AD9C5221147E02D84967D1FCDDF
Malicious:	false
Preview:	........................................j.NP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.254767112531331
Encrypted:	false
SSDEEP:	6:FpRM1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlKBUVq2Pwkn23oH+Tcwt0jqEKj3K/M:FpRrfYebqqBvFLUevYfYebqqBQFUv
MD5:	0431E6F4F26B21B31C25B959F12C8990
SHA1:	B666A12FC924FC5C8CBB2B78E0263A8EACC8E2D3
SHA-256:	7BE8EE567732DA5415EF0ECC722AC9F60204AE7811E7E2E717410E3BEE9F4646
SHA-512:	2CB5684FB49B925E855C72D44A12DE08C18A2E6B572F1F35DCE1D09733EF5E295FE9F9DD858E69EE06D20868EF2E4ECB98320AEDAAB3C982DB44E4773628FE7C
Malicious:	false
Preview:	2024/08/31-19:25:59.093 1db4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-19:25:59.628 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\05514576-d86d-43d6-91f6-35aa7c67a4ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\25e6f6fc-d461-4221-acba-40c0ec534774.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7c252622-cf06-4485-9a05-0de55b42d2a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\94f25aee-b7f4-4d65-a6b9-94221731832a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b4da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.224429837907349
Encrypted:	false
SSDEEP:	6:HA9RM1wkn23oH+Tcwt0jqEKj0QM72KLl2EYH0Vq2Pwkn23oH+Tcwt0jqEKj0QMxh:URrfYebqqB6L8EYHMvYfYebqqBZFUv
MD5:	5D9E9E6663CD0DB70E5481A3EA50BF2C
SHA1:	69EA43909E8F22197C4394E8038828EFC41E589D
SHA-256:	64272812D83CB85A7D4D4AA3BF164F371A6CE35A93A6A80792490FB75FBBC6C7
SHA-512:	EBAE199DBD4A8F46E1C8CE1F99C89FDAF1F9E264B448EBE02C20DA20ED87391836C8311C78E7510AA81D7AE340C7A98BB25C98CE3E0973307EBA15D55426E8E1
Malicious:	false
Preview:	2024/08/31-19:26:14.986 1db4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-19:26:15.010 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.2527700181317964
Encrypted:	false
SSDEEP:	6:mMs1wkn23oH+Tcwtkx2KLl1pL+q2Pwkn23oH+TcwtCIFUv:hfYebkVLDpL+vYfYebLFUv
MD5:	3A0B2F8483AA152B767CE0D4BD1DC4BE
SHA1:	3C14C32716A46C615FCA15081C58EA520A1AC9B0
SHA-256:	53FBADEA9495C2F3DBCEFC265CD511CDF310F4693A7EBD50C29227E9AEC18406
SHA-512:	AB6956BB0E89ABAB385510FEC5BB74790430C2D9B9F6A4DADB7B04381D22FD9ABCF18116F6C778C1F153CC018E05BA1BF75A3FD4BF8CC46AB27CC4FEAFDDDC91
Malicious:	false
Preview:	2024/08/31-19:25:57.191 1ccc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-19:25:57.617 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVu:IiV
MD5:	186D4516C376972D5AE610DB33E625C2
SHA1:	2752CFAAB287E360BB9A0C0C791378B0FC2C8BD4
SHA-256:	65DFE9BE9EA8CF8832697FC373A92563BADF45340C9FC315F5298B2F9588301D
SHA-512:	D0CB58A7EE01CB9C331F08CE88168D7B0BF06176DF3B62C3903603086F5BF32DE2A2C9C8D0F2AAB4EE877716B5EC9F6C1A95CEB4EF9518A14D8979D49B0AEE97
Malicious:	false
Preview:	VLnk.....?.......v.s....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.077087797462856
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOKSAE+WslKOMq+vVumYPun66:e/2qOB1nxCkOKSAELyKOMq+vVumRp
MD5:	FBC960A52001E7188DACDE1C275F6CCA
SHA1:	D491EB088973997BCD205102D3D5206BDA53586B
SHA-256:	097116FFF036D354F9DAC738176090E85F3EB0A482A570243ED05F3D6737CAC5
SHA-512:	DDA7FDEA6BADAC32BCEA93D0B795FEF79572BFC0C1E147AED24DEC343F87F245A51109861831E94011DFB15B43E5D773E9E2EA5EB7A6B43E23D2BACAEF9A6078
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\d484f8b2-3240-441b-ad39-cfa2c44b9e72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6426
Entropy (8bit):	4.982380435015236
Encrypted:	false
SSDEEP:	96:stoqftis1rb9AB/N8zYDts85eh6Cb7/x+6MhmuecmAediOQBn2MF/EJ:stozss/NkGs88bV+FiApPFMJ
MD5:	B935240623E653E6BA25769CB99D2435
SHA1:	2B92BD489784E436FBD3974B0485895E863EBD33
SHA-256:	71DDBC8B7803FE78DA1F33464EDAB1B343F1293A73828E7E26BBA91E0C9BF6AD
SHA-512:	18BA4E4A460A52EF1E07A0C79A28F87BB84659A1E18BD68A7A31D7F7C6D2266F077C29665F28098D6D3D7EF26229E192122FF9C7C5FEF8C2EBB069E6BAF252CF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620358945846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620358947603"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e664efa8-bb0f-4901-9560-e69f9c5b2ca0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566231879247194
Encrypted:	false
SSDEEP:	768:kjeK+NWP9Vfn38F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFlKtA3rwN+pGtuG:kjeK+NWP9Vfn3u1jaB/k7Nbtx
MD5:	09B3952774C026FFCC7940B1678CC90F
SHA1:	41FD6DD802B52FA48C53148D289A21929FAAEDAF
SHA-256:	DDDAAE513E46E90582A64FF96C328A2EA5E82DCB9404DA5C984B20DE440D045A
SHA-512:	2ACCA15361008DF307869A26D9E9ADE4315B2870C30E92B195E6D6A7775C3355664DD8ADD2D4E3464A5247106C029DBF02DF6CEFD4657EF01F9AA8BA40C25057
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620357115874","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620357115874","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/suf/FlFll:7+/l/df
MD5:	F6B91056A333FBA3A9DAB73E6AB67605
SHA1:	EDFF3B4F10E40E4A83A9B2D33BE4A95826EA42A9
SHA-256:	E7E671CC7AC030E21B970F2F6B53B876B40E180E26E3B127196F252E92DD6B5F
SHA-512:	51FA33B11E5C02ED9836C0D6F64A411354D675103AA9D0A8802DC89CEDA4E1B41CE721DDA3954370CEA4AE9CC570DA183D1DB5844DD4E3E7D0F34388451D7E28
Malicious:	false
Preview:	.... .c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049285833886677136
Encrypted:	false
SSDEEP:	6:GLW0Hp4W0HpjML9X8hslotGLNl0ml/XoQDeX:aHkH94GEjVl/XoQ
MD5:	2AE2C8DD93C123264B56A399731124C8
SHA1:	E3344602806AF852738C2A77D608E7316227FEC4
SHA-256:	C9462E49FD82EEF79945EDD9BE51540887B6B7DF8F69C57B88870B9ABCCC186B
SHA-512:	8CD19FB7740313FB4C8562083A6F3DD129C8FBA5757E5B1B60CEEA54A3EC98643688DC28837B98EE6A25BB0D9FC661FEA4EB0D0DA5D8F82833BF817516928F00
Malicious:	false
Preview:	..-.....................Z..SQ....m!(..e$.h.V...#..-.....................Z..SQ....m!(..e$.h.V...#........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9966167064048331
Encrypted:	false
SSDEEP:	48:YzxhlO+LcbX+ZoSUn9VAKAFXX+Qt2VAKAFXX+jTxOqVAKAFXX+H8nUYVAKAFXX+h:ox1VZogNs4Nsj1O5NsHXNsSS
MD5:	B6F978D254DD31DFECF4EC1A79FF43C3
SHA1:	3D9C1AC6BE24559CAC84050A8036283DF7AC79C6
SHA-256:	550FB62F21DAF48FBF130C7896780E7406744C6EBB31DD1994A43974662EBD9E
SHA-512:	BBD80C63257FA857FF8F0537FD050A7981733829A69F484979521EDD0584542930169F02EA4475B43E73905BA2C6250CD10CA481F7FD080070B959E27FF80C40
Malicious:	false
Preview:	7....-...........m!(..e$..p..V...........m!(..e$V.@.f.,SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.4788155571291535
Encrypted:	false
SSDEEP:	48:e8SSBStVgQAPkuHRHXxtIYjIYzzVFqk2MYjMYjyMAlkfAlk439:J0t+QzkIYjIYzzjb2MYjMYFYcY93
MD5:	C76C7F34C3BB700CF9EE250015B55055
SHA1:	D1DEDBAD71B4FCA609BA20E0D548FF6387C534C4
SHA-256:	15CF23EBAB7422E99B840CDDE784EDF2A3CBE250D29008177353C0116E0AB8E7
SHA-512:	C479A27748E1F108FA5D69B067CACAB08AE25DBC1EB82238D02CC929AA710EA3EF61536BF4C2B67FC28D735C0C14F6B3297F1413C9ECB8B2E59F53B82D6CC359
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1Cc.T.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.282971643703995
Encrypted:	false
SSDEEP:	6:2vm81wkn23oH+Tcwt0rl2KLlV9yq2Pwkn23oH+Tcwt0rK+IFUv:2+bfYebeLsvYfYeb13FUv
MD5:	B5E764E92C7268A6F7AA995087A9C0FF
SHA1:	98B1045B5F88791FE2A44CE653ACDCA66CB4CAA8
SHA-256:	EE2CD84EA8063896E5FB80C9D37871EB7A857B73F28E0663AE19C3E9FA0BCE6B
SHA-512:	0B900DE7308B9BAE5597AEED49726482322B9D26F4AE761A490BBAC812B4C29A62EAC348BD606C4A3E8D94DD3F6B30C2BCED62721810A90B3B6721AEF030B68D
Malicious:	false
Preview:	2024/08/31-19:25:58.696 1ca0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-19:25:58.705 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.9496800057455608
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/b8gA7QRmSnSedX2Ogp8mvRU0:G0nYUtypD32m3bXESnSotw
MD5:	A618CD56A60FA9D74FA253D3B6D69FBA
SHA1:	C27381BDFBB2E1A4BD11045337271B88E0FE52DC
SHA-256:	214E262F4CC1C997F70AB24BF8A94207F2DC6DAA194E5AEA98174BBBD5ACF393
SHA-512:	BFEF413CFE877436E1308E8A1C8162F7B3563B779A75F0B6F8BBDF47ADFBD3D3BBC933C185CBE92906E1B4BD042A2DCE0C621A604E4DE5D0049E4801CE1745EC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....5oP..................3_.......\4.................4_.....G....................37_.....[Q.\|.................38_.......K..................39_......R...................20_.....m..A.................20_.........................19_......ort.................18_......A@8.................3_......a...................4_......@o..................37_.....n5._.................38_.....LZa..................39_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.25168055218266
Encrypted:	false
SSDEEP:	6:SKVFm81wkn23oH+Tcwt0rzs52KLlsJoyq2Pwkn23oH+Tcwt0rzAdIFUv:SOFmbfYeb99LuJNvYfYebyFUv
MD5:	298DF6DBA6C86A91021C1FD0C6978DFF
SHA1:	718708966751ACAB5B8F4874F2E8B6A2254F2641
SHA-256:	0946693C9E8A565258E0099C207B341F4978C4DB7812BD7135F7829E04CD3671
SHA-512:	BC05F1A190D2D0B9E0DAE2E161FB2752A96AD0B8013A7C66202F8B2F34BECC399D7651ECBDEF7B0B1CA78D1F0DD9440AE17899B8C5B1184478C8CC5C27D47E3C
Malicious:	false
Preview:	2024/08/31-19:25:58.679 1ca0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-19:25:58.693 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl8lBl:Ls38lT
MD5:	CECBECDEF9139C4D0177377644313567
SHA1:	67C0966995C723C56CEC90F897B8FA5DE2FD1B74
SHA-256:	98C2A9F0DD26EFD63150DD83E0F72BA393EC9D65B0AA224CB4C425271CE02952
SHA-512:	04EA5512F21139F4742B4A10CD25CD6F959050B8395376BC143629D2300364E404694302F209E6F850408DC8706D37321C30C3F117176B7997D2273AB39503E0
Malicious:	false
Preview:	........................................A IP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlyl:Ls32
MD5:	3E9C6B367F18128219380BB5D83A4FED
SHA1:	18653113D6F3869B8F128139CB2CC2569B13266C
SHA-256:	C79385F7B6A2B013A8A4F6150CFFBD44B58183B8011D767BF0AE3C840705C84E
SHA-512:	E26324C55495E589BB5A796100B55172B1CF0E230B528314E0CA57A23656DD3BCDE9F488F4FC0363B5162A7A6339F91FFAE962A78A10765A51CB6C865C6E3297
Malicious:	false
Preview:	..........................................MP../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28533.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF286d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28737.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2ae57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2d874.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF31a9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF34c0e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF370fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3981a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3f8e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.522676180360022
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcEAiG1QtXvXDn4ayikiXaJdXBuBuwBsaKKNhGnXirWVQQRC0:YuBqDPafQDG8XrNOgBzBsVMGnt6B0
MD5:	9EDA1B3E1D760AE76613853B29760243
SHA1:	1CF382E3BBDD21546EABE9775C725868CFC4F209
SHA-256:	3E81371720CAE28420639A06B117AC7546002AD03030963EB4F0CACCFCAEAD21
SHA-512:	155C8BB770CC161D6140B9E511D09DAA66714814622A72E41CC22E6BDCEBA2F02A4809D038C249979DC671516F02BC986BB00D7426304E814B8588E93FB45641
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620356419442","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725146756"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlxH2T:Ls3B
MD5:	52E1B7DF208F5BD10F0F23EF3038BA74
SHA1:	29530A3B6AE544F3AFC90250D13919733E1F29F1
SHA-256:	F910A24F4B1DF8E9CF2CBDB8B07B38E403C46B171A63270A858D4C98BC199FB5
SHA-512:	64A722E9BC38EA8F074CF94B28BC7295D1CD451B1109AFD208C4093F05F084A5BD0DFD40F6CE0BBBF4B46C85DFC5AF2E5FD04EAC7529BBB39C430A3F45DE2640
Malicious:	false
Preview:	.........................................+"P../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\cb3376bd-8da9-44c4-ab98-846b8461b4d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	5.48568408493312
Encrypted:	false
SSDEEP:	96:0q8NkGS1fQDH858rh/cI9URoDotomOBZ1vmj67JkAc9SSDS4S4SDSc4I4a:/8NBSOzNeoDUsQ6dkAuu
MD5:	0EA87C93EC8F57F609C40135B5D121B9
SHA1:	C425A27061DACA9DD9314367DC6E933A1E7ADB74
SHA-256:	6CC1F138A4F3E96885095B96339FCB808107628F775175E3455CAF323FCA9C42
SHA-512:	2737E2E2193CFBE54A08473CD1F3AB6B90BD9663248B5AF46A67D2357DA864924AFC10130605675F23D1EF1080644C2FC8451C3436E1D298767D98C2DEEDDFBA
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\d7c25488-3b75-49de-939a-cb16937105a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3334
Entropy (8bit):	5.5989800561192515
Encrypted:	false
SSDEEP:	96:0q8NkC1fQDH81+BZ1vmj67JkAc9SSDS4S4SDSc4I4a:/8NbOzzQ6dkAuu
MD5:	5142443D26B741B3CD151F78437CEB09
SHA1:	80F6216F0804EB7D23650359BEF37B7C5B38A030
SHA-256:	FF98BB8E7B5E5FB4788CCDCB29D5828C2B42F904A25727AE2F53D88F51777A3B
SHA-512:	A9C05156A4237665CDBB1110C59B9B78FC8A546666DD500A461170A674265E6BCD5BA1398D405BC4B4F1D005E78AC4426DB66A2D96DC0FC2AF9E1490D6227465
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\dd6a7900-6591-4a40-953b-90478f05b0a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.575493997072944
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afQDG8XrYOkHB+EzdrxfvBsVnkRmOadyaJkXwccwlRvrB0:Xq8NkC1fQDH8xBZ1vmirad7JkAchDq
MD5:	74E40E26C6F58DFED31E000352018FF2
SHA1:	A82831548335025DBF0675954128EBA939D3E61C
SHA-256:	F62BE8B9FA1717F19D28EA5085A4FB21597B21601EDF68716882D88506DDBA1E
SHA-512:	742E1F21BB7E72D1852B85192491D37F517D153453E28D613B0B69E87746924820AF4889B5305EE0F4A13EB98570EB7E7FBB63511F0D3D155EDFCF81AC580F9E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACQe8ROJtLcsm0BjdPGerUHu0tWKnnh53jrx8wImovfQAAAAAAOgAAAAAIAACAAAACLl/s+mwfX2hL3f0YNYnKOF5886ta/FfrvnVJh33gYDDAAAACex/tpBFOgS+0/xpajhq0/s6DT0g9Tifo9sTH37fVI33GswJi8MLJuDzfaks3dqlhAAAAAvvVI+6MIq2Kc49FDCLCQNXlySxw/ru2r3J2fPfrchbk/oqO5tNe26+AtJ2oUUD+ia/E7zVWLqN2EY6+PTjUrfQ=="},"policy":{"last_statistics_update":"13369620356518562"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\dfd0e9d4-e899-4ece-ae22-1ea2e7f0f2db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.064987949192236
Encrypted:	false
SSDEEP:	384:MtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS3a35tuAvV1PdQYT3W4Ad4nR:MMGQ7FCYXGIgtDAWtJ4nbUtuAvV119WS
MD5:	235D8F3110FCD506A40B508DD380CAC1
SHA1:	0B2F50EE106CB6C7F33D8140FE1D89B70A0A4572
SHA-256:	691ACE5F464C9FE8AC5E2769ECD98738C25D3CAFA8382DEC2570F7D58DD4F3EE
SHA-512:	FD63BBB658648F9E1543514D7173284171620F03C643BDAAE21D25F80CBC1A09EEB09C1A9D414E2B4ABFDCDCE5E59C6BCE12BC99C381B1CCF2DFDD886B89669B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620358989349","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1e14afe9-e6a4-4644-8408-9450dbc39397.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833552563525542
Encrypted:	false
SSDEEP:	192:fsNwo3ReiRUT819Q5Sty4kAa796qRAq1k8SPxVLZ7VTiB:fsNwgi8O5LDAa796q3QxVNZTiB
MD5:	31C8B33890C451355AD6D63D10927CA4
SHA1:	586126617D977DFD1038A195F497FAA35F6C0AF4
SHA-256:	ECB5276A324DB9DD1B0911AB1883B7B349F40BB63E4EDF19BF5547F9EC8EC3B4
SHA-512:	105E918A0FDCC892E774D4F071C5004901CE1FBFB3E547FBA5B15B2579F87BF1933141DF9FBEE9560DE3F8B58383ABC03623B959308E773E572817C0557E2623
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1e4e5a6d-f7ea-47ee-8c95-311d7a122cea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833552563525542
Encrypted:	false
SSDEEP:	192:fsNwo3ReiRUT819Q5Sty4kAa796qRAq1k8SPxVLZ7VTiB:fsNwgi8O5LDAa796q3QxVNZTiB
MD5:	31C8B33890C451355AD6D63D10927CA4
SHA1:	586126617D977DFD1038A195F497FAA35F6C0AF4
SHA-256:	ECB5276A324DB9DD1B0911AB1883B7B349F40BB63E4EDF19BF5547F9EC8EC3B4
SHA-512:	105E918A0FDCC892E774D4F071C5004901CE1FBFB3E547FBA5B15B2579F87BF1933141DF9FBEE9560DE3F8B58383ABC03623B959308E773E572817C0557E2623
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2d43bd36-bbcb-4ab9-acc1-53a88ea65556.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59726
Entropy (8bit):	6.081675614663658
Encrypted:	false
SSDEEP:	1536:gMGQ5XMBGPaf8dP0SiFYXyBb7LiZGVNzrr:gMrJM8CkdP0SYLpviIVNzrr
MD5:	640A0E6D50FECED92075F8E0E6579196
SHA1:	DD8D57606A88A7638403181DB2EE0C9DE9156C76
SHA-256:	19BDBACEA6FBE74E382D3ADFDCC318F72ED6CEC65A81B60BA64173C6B6F50795
SHA-512:	C657D856B15D16C189F91C16EDC9F91943C09E85FA3CF42040F4055DE5ED22C1CA621C4508402F0A12B6230886C6513E8013B992AFF70B01EC2915665B518072
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620376543077","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3a645a9e-7866-4cff-9988-a2c03f9628d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	59765
Entropy (8bit):	6.081663916809263
Encrypted:	false
SSDEEP:	1536:gMGQ5XMBGGaf8dP0SiFYXyBb7LiZGVNzrr:gMrJM8nkdP0SYLpviIVNzrr
MD5:	A02DD4E81218900F7105B55C3921FB43
SHA1:	5E4DB796CCF380496CE62EC3DC7AAF4339C4AEB1
SHA-256:	7FCDD9C6F02CD7BA95944D9532A46F23B769352CE7A7A0D832A8E9AB467CDF92
SHA-512:	AC230FA4DC17D6D80EE35229944BA671AD89E710A271A74C899BFFA30360C54EF86081DC3E77222D666AE6D00D6DADB50B9240CED88E26AF8F4446E7C3FA7DDD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620376543077","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4819995f-5181-45d4-a862-dbf2dc38d009.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22002
Entropy (8bit):	6.058663640065362
Encrypted:	false
SSDEEP:	384:AtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwgPe6Aa5+Mh0lkdHd5q4:gMGQ7FCYXGIgtDAWtJ4nme6A6h02tdj
MD5:	94B079B0CBE087518D7C00799BDCCE23
SHA1:	5F0C70D383A8224F9206590BCC78CE629C97B616
SHA-256:	05FA648BB0D53FB23BED42022996B12A98C7F63BB5AF9C01F50CAEC17409711E
SHA-512:	4ED305C4317F4302AEE87D4308A0D7F69E7AFBD5F0F35AC416D9E6AA99C64CB699E2AAF6A5E6C7839CDC41A097EBB3FDEEA88DA527469951F17D5DE962859F04
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620376543077","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\752d8b50-a12f-4905-b9a1-0b234b220244.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e0c2793-c63b-4e41-9733-73a621b76369.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798363899109955
Encrypted:	false
SSDEEP:	192:fsNwo3ReiRUTfQpkAaC6qRAq1k8SPxVLZ7VTiQ:fsNwgi46AaC6q3QxVNZTiQ
MD5:	BAEE71FB54025A04D50DAD8F4ADADEED
SHA1:	1F431E28444160FBC5AA82A391F89856F01ADBEF
SHA-256:	B946E6A2CAAB46C9D979A62A66D898B7EA0B2C1C7B869B67AC12CF44BDC0B5A3
SHA-512:	30F162DCE2110A81BE95C23E9111C878A801AF92814CBD15BFB753B7BA11FBCD645B3057FE36368A00322DEA960F62A4036D0C045C443C16F89A487D99A4128D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\91027bf2-814a-4262-b67c-76bc82f369b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833357189007831
Encrypted:	false
SSDEEP:	192:fsNwo3ReiRUT819Q5Sw1SkAa796qRAq1k8SPxVLZ7VTiB:fsNwgi8O5TRAa796q3QxVNZTiB
MD5:	E3765F1ED273A4E9313341C85F150AA3
SHA1:	98001B2395694721273B89A6D8CA07A6E1F1C11B
SHA-256:	35456098DA48269DB8F9C6356562B60F005298FDDCC5A0BCA97052DF7413EB2D
SHA-512:	158B8E81E8BF0839A070666167ACFC01B484536780998DBE51A4A77064CBD60113E892107773E3FEDCD2CE4A42A4C220AE0C840C4725EC17EC691C8E6DB1825A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\92186860-059b-4cbe-8b8f-2b89d71d1fea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59726
Entropy (8bit):	6.081673195498733
Encrypted:	false
SSDEEP:	1536:gMGQ5XMBG/af8dP0SiFYXyBb7LiZGVNzrr:gMrJM8SkdP0SYLpviIVNzrr
MD5:	A72839B94246D9384AE6C7CA22543D28
SHA1:	0E559CEDED9A040528198BDF98AF0231B05E1ACC
SHA-256:	56108653F94D805B5B073DF32781D7481FDDC7F0BFD5C36605CC29E864EC4EB6
SHA-512:	85264170BB320FA9FDB4ADF2EBAA9846177EBB771FD8A5F501AE2999219466580079D8D971C4D8D322F4CB33DC8E3017B811C546EAB24D694D6325CF0D9936A8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620376543077","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c381af7f-3cc2-44a1-b4e5-999601221954.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3A698-2380.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.31048107233309974
Encrypted:	false
SSDEEP:	3072:L0eqPlv0g/55McjHU8V9rbF11CkfeqIH2OoVRF4IZO5cLANQ8nuq8XxlfCAm8MGz:E5R5ZC8vIH1BqleMaHhYR3
MD5:	BAB1CB81A70701C288FEF2C0342BB934
SHA1:	F40D9836D2D0582D27273BAAB7923DED7F29A7C9
SHA-256:	98713A809AC3FFE8DBCBEEBA1056B1D3CAADBE4BF6304E8E7A1711B17923CDF2
SHA-512:	D586857EFDD9DCF65939A150A7FC21C05285F8DF08505325C076D53CDD839BF213D7A0569B7DD4CA95EF23B58CD2A755EF1FF74703F37D7EE731D9F7CB11CE4F
Malicious:	false
Preview:	...@..@...@.....C.].....@............... L...K..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".nenkrs20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3A6A0-4EC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039753136980651534
Encrypted:	false
SSDEEP:	192:Py0EbtmqvDtKX798JEa3XxxTVwg7X8iV0DA5DhAVNawPU1gQMGB11Dq01n8y08TQ:q0Et5eQtpnhUhkg81dX108T2RGOD
MD5:	4335557F9A5446DF9AD4ED8BEE5302C3
SHA1:	7B61AB8F5915C5C75259B79B6E0D4278A07A37D6
SHA-256:	218756838CEAB2A0B38FAA706155B485D1DD6BFC705D01E4FFF576AD1F47C2D2
SHA-512:	3CC3178F63E0B25BFAE85B2C31E73B71319ECFA2C767894758D7526B05A98DE14A13A3F66D05F7A84E2CD907DC2DE239A9CE531A259BD794E508D0E05BDB9885
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".nenkrs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3A6A8-2088.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038822149992160014
Encrypted:	false
SSDEEP:	192:0C0EbtmqvD3KX7eAJEa3Xxx7UpXxgg6zfhj1NEroDtM1gQMpBOi+q2n8y08Tcm2D:p0EtdAeZVQh53BsgNBch08T2RGOD
MD5:	19C346460FA347853E2C9515EE246BB1
SHA1:	075C20691C1AA5157D5D4F06C8BA346BE29E8D5A
SHA-256:	7214BEEE3241C8360C39E1450BC4B5E845074D5A7674071580B55F6CC7ED5AF3
SHA-512:	6513C111D6165240D4896D975CC437EB24CD2DFD3162BACA752AC2ACE570AB47AC72BCBFE35287952AF0682B590A85DAFCBC4BCA832F46E774CC59F07A13EE1D
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".nenkrs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3A6B5-1F94.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038826057596013555
Encrypted:	false
SSDEEP:	192:0g0EbtmqvD3KX7ejJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMCdOwfq2n8y08Tcm2D:30EtdjeZVQh5WWsg+dDh08T2RGOD
MD5:	7C54270AE9590EC3D1023692708FAC9D
SHA1:	27EDEAB24C6564A48FDF013711E8E177B7CEB063
SHA-256:	85B85EC2BF3B469929C31AE1ADE585C94FBF7536C96F35C0689B52C0A5554A3A
SHA-512:	0F042D174FE5F631C451E311A42741F729452818587B15BAC6387C913C9DAC9484483208CB619BF432890FCB16FB0DDF7F89A804FCCDDD055078A01A5BB250E0
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".nenkrs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0d1338dd-76c8-4006-999b-017901ba0e76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.185134830900089
Encrypted:	false
SSDEEP:	96:sVGjqlLJ1jb9EBDYuX0dquSSx3OqdY1sY5Th6Cp9/x+6M8muecmAeCh/e4zvr724:sV6YJ8DP8PY1sYPpj+FVAB7FBf
MD5:	42986B26C749F61129F7145389263286
SHA1:	00A549FA21BE894107663D1FD3F885C642490851
SHA-256:	CA4797671BCDFA05855E751623E7FDE9041414F53D24C3F727FEA045C992E8BD
SHA-512:	226F5EEE668C2F5A7733E536F146B0BDDD278A4DCB7B6ABF940D61F85BA569859563EF226626ADBD393510E803E596EA829569CD4004DF0B9EA3D01A9B94ABB8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369620376524544","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0ea10f97-06fc-41d5-bad7-db1f80573326.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.183901453117132
Encrypted:	false
SSDEEP:	96:sVGjqlLJ1jb9EBDYuX0dquSSx3OqdY1sY5Th6Cp9/x+6M8muecmAeCa/e4zvr724:sV6YJ8DP8PY1sYPpj+FVA27FBf
MD5:	6D172EC570713F2CEB93BDC28FAA99F4
SHA1:	CEDA0F27E0155A14799206FC55AD3E80A06BC0DD
SHA-256:	2C6E28D2194422FEC8D54F6E26FAC3E4B661DBAC26AE5FA2E77C1BA69457979F
SHA-512:	23601C3074DDAA12D625F061BBAE1B2F9652B8A5C2F21C5835AE0653FBA1F6B9BA488DC92400A2CFB8FBAC297813F09C4ED6477E3DC6FCFDB0843B8B3ADC0A21
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369620376524544","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\23c9c306-f493-430c-8634-ab5a3e629f0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\90233894-e407-40c7-b366-5d37704e1251.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.5657377928730725
Encrypted:	false
SSDEEP:	768:AOpIDq7pLGLv7CWPAqfuA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuWTh7a6rw0ziQj:AOpIDCcv7CWPAqfuAu1jaHWTNa/0u2tz
MD5:	30CC9573D6FE5ADD65A85DC0DA9BCFEB
SHA1:	2FB40A3EB9FF015CE30EAE684DC1A67BE0576857
SHA-256:	D46C9449E9CF3C03D8C6FF603B478B1348F0ED7466214C56951C30F444659EDA
SHA-512:	81976D854A3B8FAFC59C97AAA8DF6CFF149B322A5F818375F7D8557DD2E659915316A4D6CF714CBEA7CAF21C2E694C917D0F056659609680483155345F0504E1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620376392768","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620376392768","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321077904275712
Encrypted:	false
SSDEEP:	192:zAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:sOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	81ABCC82E42631D2CB5E76308E535F23
SHA1:	75CA139F4D6DD3334FEC3764157449C8B17F8919
SHA-256:	D7FDAAEDC86404754DEE3C3060FD5C3C4BA534F3854A27441A60A36EC72C93F4
SHA-512:	F40E86B08D8BDF3EF65125B76501AAC64DE7718371F3283B1212AA69FB22F80CFE13A7BF56000EF2111F97B397C650370CED7F18B35584B65A45ACDD44D1D777
Malicious:	false
Preview:	...m.................DB_VERSION.1..4..................QUERY_TIMESTAMP:arbitration_priority_list4...13369620379413874.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.114530931471623
Encrypted:	false
SSDEEP:	6:LaGc81wkn23oH+Tcwt9Eh1ZB2KLlJFO+q2Pwkn23oH+Tcwt9Eh1tIFUv:GGcbfYeb9Eh1ZFLQ+vYfYeb9Eh16FUv
MD5:	E67338EA9DA0611B3C03FE7533622A58
SHA1:	6AB3D54FD40A46F28B76B4FD0776F0E3EDFD008C
SHA-256:	913C94FD99BEA0CDDE2B083FEA23250732406271958129623264348B6303DC50
SHA-512:	F0959881EF52244A6097DDF5E3C17F518CC162532D5466BCE253A557DD1CBCD606CDDAC7B5826242A05CAA42F0D9959A9A386AAFAFF3AB97984BA0E914DBF985
Malicious:	false
Preview:	2024/08/31-19:26:18.270 224c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/31-19:26:18.422 224c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlO+/:Ls3
MD5:	9D1D9AEB7668BBC4C28616D14F76D8C0
SHA1:	BE4305439397750F81A379B15CB1C13D444465BB
SHA-256:	3BE52B12E553729BE5B6211BE4A2FB5B0451145C2D3F25F309623175B7856ECC
SHA-512:	42F4CECBC8D733CAB2E5F334C680794E8CB9B5D91748B788B69742941A894F8DA5948A442D6453C9CD958D6CB062BB8C4E37247FBA614830DF66573693E06766
Malicious:	false
Preview:	........................................U.XQ../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.245947825638127
Encrypted:	false
SSDEEP:	6:Fe1wkn23oH+TcwtnG2tbB2KLlHlUUSQ+q2Pwkn23oH+TcwtnG2tMsIFUv:FpfYebn9VFLtsVvYfYebn9GFUv
MD5:	5DA80D193A41825D1345A85FDBBDC673
SHA1:	495B75914A8DDED81EF8B7FCC21D3456F2023B7C
SHA-256:	5718A8F8AE2F7F49708446D00B64BFAFA3C7AADD50E446A1C8441B728FA18689
SHA-512:	AA797A6F2091820896B4F4DA6BCD12834119A003AF564F9FBEE4AB1A1A1D6FB88DD8C2D7C03AF2F437337B5A2FCA088F238AD324E7B354D580B8F4493B9E2536
Malicious:	false
Preview:	2024/08/31-19:26:16.396 2078 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/31-19:26:16.414 2078 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.206953877170274
Encrypted:	false
SSDEEP:	6:Fm61wkn23oH+Tcwt8aVdg2KLlHlU9U1L+q2Pwkn23oH+Tcwt8aPrqIFUv:FmFfYeb0LtdyvYfYebL3FUv
MD5:	8A8A428A618B724150789BD80A2CBF23
SHA1:	8A0DE892DC9F5FC7C53263A363C9DA1FCFDA6210
SHA-256:	D6BD4686A664BD6C07E5D67A3C46687A7711A90372BE08EE436F39B4F7519448
SHA-512:	0563DB4CD720E8F83A170F061663C5DB07F701959EABC64279D939821E075331E4D3F610A1E8F2A3D78030CE3A9D0A0B1BA3BA2A1198FCBEB0CE9C05ECB98BF1
Malicious:	false
Preview:	2024/08/31-19:26:16.399 2058 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/31-19:26:16.412 2058 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.193468171766429
Encrypted:	false
SSDEEP:	6:FlcR1wkn23oH+Tcwt86FB2KLlHWtU1L+q2Pwkn23oH+Tcwt865IFUv:F5fYeb/FFLtWtuyvYfYeb/WFUv
MD5:	36868F97C4A938255801FCDF3D909E2A
SHA1:	7E378149B3051D2382767BE74BCB3BDFEDFE0CF1
SHA-256:	5F70B9E60E768118F2F9A946AE8617D154B964A9C44C1F1568A9BD20D98B0C6E
SHA-512:	B4B750F909E09A080BB7DB46A7C0F5B92C06D9ECC2E583258A2146C2F2B485542257BF0E7C5D126D21C004AB4D169C5863BE3ECAB165E4E24D53465388A22C28
Malicious:	false
Preview:	2024/08/31-19:26:16.448 2058 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/31-19:26:16.511 2058 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.2224341210399166
Encrypted:	false
SSDEEP:	6:FCq2Pwkn23oH+Tcwt8NIFUt8wy/XZmw+wy/FkwOwkn23oH+Tcwt8+eLJ:FCvYfYebpFUt8wy/X/+wy/F5JfYebqJ
MD5:	849AA2D0B397FBAE1AF0B209B6EB5052
SHA1:	B9ED213C1D67CFB5EE810B6636555DC57DAC91E9
SHA-256:	9D2595EF6EDFD4F0CD75AB7192A12842AD0CBF896DC2289A859E5EC61E70BDDD
SHA-512:	1F5C5804901D35B6E9036C236ACCF07FCF987D2FB8BA5A3A91C1FB84E23514C7CF37740AA5CAC82CFA0B179EE356C940CEFAC2168E5E35D9B28E46A371AE8C01
Malicious:	false
Preview:	2024/08/31-19:26:16.572 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-19:26:16.573 1f10 Recovering log #3.2024/08/31-19:26:16.573 1f10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.2224341210399166
Encrypted:	false
SSDEEP:	6:FCq2Pwkn23oH+Tcwt8NIFUt8wy/XZmw+wy/FkwOwkn23oH+Tcwt8+eLJ:FCvYfYebpFUt8wy/X/+wy/F5JfYebqJ
MD5:	849AA2D0B397FBAE1AF0B209B6EB5052
SHA1:	B9ED213C1D67CFB5EE810B6636555DC57DAC91E9
SHA-256:	9D2595EF6EDFD4F0CD75AB7192A12842AD0CBF896DC2289A859E5EC61E70BDDD
SHA-512:	1F5C5804901D35B6E9036C236ACCF07FCF987D2FB8BA5A3A91C1FB84E23514C7CF37740AA5CAC82CFA0B179EE356C940CEFAC2168E5E35D9B28E46A371AE8C01
Malicious:	false
Preview:	2024/08/31-19:26:16.572 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-19:26:16.573 1f10 Recovering log #3.2024/08/31-19:26:16.573 1f10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:aHA/J3+t76Y4QZZofU99pO0BYQubqR4EZY4QZvGTD:aghHQws9LdOOBQZGTD
MD5:	CD88A01197EE630DC39BE0103823F46A
SHA1:	B555B20C8ED59463FBC6A6DC168AD864B77B54CB
SHA-256:	12F97AF0BB655803FC446916E4D15CE78317BE369E00BBC9F809770EDD4BEE44
SHA-512:	2842688C58B7D3F32F7D70FB9FC117A43AFE6499D5F18169C529E1EC282081C95516645AA8A2DBA528D6C7D8E14D52285AA9F18BAC80FD8B249C32F84F34F421
Malicious:	false
Preview:	.............b.....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.309856604361324
Encrypted:	false
SSDEEP:	12:QvYfYeb8rcHEZrELFUt8q/+W5JfYeb8rcHEZrEZSJ:iYfYeb8nZrExg8cJfYeb8nZrEZe
MD5:	103BACCBDB78F9CA0D3FCC11BF370AE3
SHA1:	68C2A56B3A5DCF2519EC760D1970CCDD3DF74BFC
SHA-256:	679CD043A9694657BF76E2DC194AA6C27B9E33D9D5A09755E64DB685C87CD741
SHA-512:	DDC7B4521AD5E853AE80DC188E7BB9E9C381B5AE34AB20B52BC65886F89CCCD5ACC0DFD8562E3E8F1C545BC98E80F95BB13462FB173AA7DBCEFD7F42FE0BD2E8
Malicious:	false
Preview:	2024/08/31-19:26:17.776 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-19:26:17.776 23f0 Recovering log #3.2024/08/31-19:26:17.776 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.309856604361324
Encrypted:	false
SSDEEP:	12:QvYfYeb8rcHEZrELFUt8q/+W5JfYeb8rcHEZrEZSJ:iYfYeb8nZrExg8cJfYeb8nZrEZe
MD5:	103BACCBDB78F9CA0D3FCC11BF370AE3
SHA1:	68C2A56B3A5DCF2519EC760D1970CCDD3DF74BFC
SHA-256:	679CD043A9694657BF76E2DC194AA6C27B9E33D9D5A09755E64DB685C87CD741
SHA-512:	DDC7B4521AD5E853AE80DC188E7BB9E9C381B5AE34AB20B52BC65886F89CCCD5ACC0DFD8562E3E8F1C545BC98E80F95BB13462FB173AA7DBCEFD7F42FE0BD2E8
Malicious:	false
Preview:	2024/08/31-19:26:17.776 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-19:26:17.776 23f0 Recovering log #3.2024/08/31-19:26:17.776 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.219322061453431
Encrypted:	false
SSDEEP:	6:F+q2Pwkn23oH+Tcwt8a2jMGIFUt8pZmw+AFNVkwOwkn23oH+Tcwt8a2jMmLJ:F+vYfYeb8EFUt8p/+AFNV5JfYeb8bJ
MD5:	18704029940ACCDDEC76BF02AF31B1EA
SHA1:	37CE9DD94D265C98D9CD0E6103A3F16CAA9BD04B
SHA-256:	1CD000F39EEBF5E9CB4AD201B160AC1E7B4C3270B71BCFD88FC33591DBAB6D1E
SHA-512:	ECABE88BC510867B16554BC85C9FA0346964B4AFB2D1106211DBDD6F40D412A84658446147798B587AF84F0D9DBE79767840EA80487E64394FC5AEB70544A067
Malicious:	false
Preview:	2024/08/31-19:26:17.386 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-19:26:17.387 229c Recovering log #3.2024/08/31-19:26:17.393 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.219322061453431
Encrypted:	false
SSDEEP:	6:F+q2Pwkn23oH+Tcwt8a2jMGIFUt8pZmw+AFNVkwOwkn23oH+Tcwt8a2jMmLJ:F+vYfYeb8EFUt8p/+AFNV5JfYeb8bJ
MD5:	18704029940ACCDDEC76BF02AF31B1EA
SHA1:	37CE9DD94D265C98D9CD0E6103A3F16CAA9BD04B
SHA-256:	1CD000F39EEBF5E9CB4AD201B160AC1E7B4C3270B71BCFD88FC33591DBAB6D1E
SHA-512:	ECABE88BC510867B16554BC85C9FA0346964B4AFB2D1106211DBDD6F40D412A84658446147798B587AF84F0D9DBE79767840EA80487E64394FC5AEB70544A067
Malicious:	false
Preview:	2024/08/31-19:26:17.386 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-19:26:17.387 229c Recovering log #3.2024/08/31-19:26:17.393 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f9c9225-f25e-4ec6-9fdc-b6cec41f00af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\47f2d0a1-37af-4310-9bc8-538e6642f44d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\987ced2f-256e-404f-83cc-25611b150211.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3008e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3ecc2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d9bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e48a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3008e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1cd54cb-06e1-45b3-b5d7-1b1b5a3f7a11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\be68c1a9-1f32-4ae4-a8e1-ec15092f8b99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.286919012557072
Encrypted:	false
SSDEEP:	24:YXs8ZVMdBsKVZFRudFGcsX7ZFGJ/dbG7nby:YXsk8sKjfcdsX1gzbZ
MD5:	854A24A979E242E7A6C330DC6E1EF765
SHA1:	BB283E73A60C7D4ACC9DBC72A3EFD6ED65DC6CA1
SHA-256:	190F689EF2A67E1196632C62D350F7FD1B9EFFA7D4F60C2E9B69FC89917C8C66
SHA-512:	8585B4AE9DD14FBF8C6BD14BC902ED747D9D32F2E42779A4E71304A6C53C78484D1914E2C200AA016DFA5F6597F74DA085C463B536D2BA57DE691293CA3E9E61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372212378712072","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372212379810302","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372212382271953","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ceaea818-1291-4598-8650-3497b470de5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1e69988-77bc-4862-9ca3-61cf295a47c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.068305459729878
Encrypted:	false
SSDEEP:	96:sVGjqlLJ1jb9EBDYuX0dq8Y1sY5Th6Cp9/x+6M8muecmAeC3e4zvr72X6gE5AtE7:sV6YJ8DPwY1sYPpj+FVAr7FBf
MD5:	9340CBA6683D126CE32F107EDB0FA694
SHA1:	D48E8B2FF31F52EFCB5247235ADF5EAAC6E493D2
SHA-256:	32D7EFBAB7DBA190B288215D1D58A5F146177082EE456A74240FE2A45D594678
SHA-512:	4818F641DBA6141260731FD1F735221B3B3B03EBB49AD3F8447B4BBF3431E297C448585BE268A0B6FA62610412D58936740CA183C2EB4D2BD80E41192AD5BD15
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369620376524544","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3542c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.068305459729878
Encrypted:	false
SSDEEP:	96:sVGjqlLJ1jb9EBDYuX0dq8Y1sY5Th6Cp9/x+6M8muecmAeC3e4zvr72X6gE5AtE7:sV6YJ8DPwY1sYPpj+FVAr7FBf
MD5:	9340CBA6683D126CE32F107EDB0FA694
SHA1:	D48E8B2FF31F52EFCB5247235ADF5EAAC6E493D2
SHA-256:	32D7EFBAB7DBA190B288215D1D58A5F146177082EE456A74240FE2A45D594678
SHA-512:	4818F641DBA6141260731FD1F735221B3B3B03EBB49AD3F8447B4BBF3431E297C448585BE268A0B6FA62610412D58936740CA183C2EB4D2BD80E41192AD5BD15
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369620376524544","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e3aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.068305459729878
Encrypted:	false
SSDEEP:	96:sVGjqlLJ1jb9EBDYuX0dq8Y1sY5Th6Cp9/x+6M8muecmAeC3e4zvr72X6gE5AtE7:sV6YJ8DPwY1sYPpj+FVAr7FBf
MD5:	9340CBA6683D126CE32F107EDB0FA694
SHA1:	D48E8B2FF31F52EFCB5247235ADF5EAAC6E493D2
SHA-256:	32D7EFBAB7DBA190B288215D1D58A5F146177082EE456A74240FE2A45D594678
SHA-512:	4818F641DBA6141260731FD1F735221B3B3B03EBB49AD3F8447B4BBF3431E297C448585BE268A0B6FA62610412D58936740CA183C2EB4D2BD80E41192AD5BD15
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369620376524544","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557584518217631
Encrypted:	false
SSDEEP:	768:AOpIDq7pLGLv7CWPAqflA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8h7a6rw0zikpf8:AOpIDCcv7CWPAqflAu1jaNNa/0u4tO
MD5:	EBE350EFDC588C983947E866310AF4D8
SHA1:	189B4B21F204F9B272E9BBA71E23415596CAD639
SHA-256:	B7F79364094F8D8BE77B27BCC839D711478D0A2F7206C32022C1E28A5BE96EF0
SHA-512:	32B1A67F376FB310199B7937515529C56BF0E9C1868BD5A7C83AE5B789BDF7D71070560D03DC54C0AF4BA9E4D78E509F02ABFD997DCE3ADCC1528E0617F279ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620376392768","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620376392768","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33886.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557584518217631
Encrypted:	false
SSDEEP:	768:AOpIDq7pLGLv7CWPAqflA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8h7a6rw0zikpf8:AOpIDCcv7CWPAqflAu1jaNNa/0u4tO
MD5:	EBE350EFDC588C983947E866310AF4D8
SHA1:	189B4B21F204F9B272E9BBA71E23415596CAD639
SHA-256:	B7F79364094F8D8BE77B27BCC839D711478D0A2F7206C32022C1E28A5BE96EF0
SHA-512:	32B1A67F376FB310199B7937515529C56BF0E9C1868BD5A7C83AE5B789BDF7D71070560D03DC54C0AF4BA9E4D78E509F02ABFD997DCE3ADCC1528E0617F279ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620376392768","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620376392768","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.167006718146809
Encrypted:	false
SSDEEP:	6:raGFN+q2Pwkn23oH+TcwtrQMxIFUt8SOlHZmw+SMGiVkwOwkn23oH+TcwtrQMFLJ:OGFN+vYfYebCFUt87lH/+YiV5JfYebtJ
MD5:	739A9948A32A7E38DBB6664F511EF107
SHA1:	0BE7D46036DE560535839E3AE2400D578AB69C53
SHA-256:	A881F615998E4EDC7C383666587C9F18345B139C47F72F52FD5E64BEBC938B7E
SHA-512:	C39AEBA223A61B8B2F01BB0CC259E4D5472FDE33D3F3D298DB06F9D9E87EE241020312B1C9E2DA2D3DB4BACAD0FA7572A63543DDAD4772F87A3EE781A979BD8C
Malicious:	false
Preview:	2024/08/31-19:26:32.521 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-19:26:32.524 229c Recovering log #3.2024/08/31-19:26:32.526 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.167006718146809
Encrypted:	false
SSDEEP:	6:raGFN+q2Pwkn23oH+TcwtrQMxIFUt8SOlHZmw+SMGiVkwOwkn23oH+TcwtrQMFLJ:OGFN+vYfYebCFUt87lH/+YiV5JfYebtJ
MD5:	739A9948A32A7E38DBB6664F511EF107
SHA1:	0BE7D46036DE560535839E3AE2400D578AB69C53
SHA-256:	A881F615998E4EDC7C383666587C9F18345B139C47F72F52FD5E64BEBC938B7E
SHA-512:	C39AEBA223A61B8B2F01BB0CC259E4D5472FDE33D3F3D298DB06F9D9E87EE241020312B1C9E2DA2D3DB4BACAD0FA7572A63543DDAD4772F87A3EE781A979BD8C
Malicious:	false
Preview:	2024/08/31-19:26:32.521 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-19:26:32.524 229c Recovering log #3.2024/08/31-19:26:32.526 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1838206165205465
Encrypted:	false
SSDEEP:	6:FY+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8wPH5Zmw+wlC/3VkwOwkn23oH+Tcwt7Uh2w:FtvYfYebIhHh2FUt8w/5/+w8/F5JfYeQ
MD5:	DC5DE90308ACFF817D086B7434C9B168
SHA1:	9206A3F7CD3523B9909C3F7C9AF178596CDB05AD
SHA-256:	3B6912D3B000E7011D98211BC512E0ABA175FB11E5DB9360E6A703981CBA31BC
SHA-512:	73ACC7C71C036963AF82326A305F65F7D7413F0287180412322052B66D7FAF0E09079F20F06EA808731DB91D7265FEBA7D3C1AAD66C00071F9AC8351379460C0
Malicious:	false
Preview:	2024/08/31-19:26:16.391 20b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-19:26:16.392 20b8 Recovering log #3.2024/08/31-19:26:16.481 20b8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1838206165205465
Encrypted:	false
SSDEEP:	6:FY+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8wPH5Zmw+wlC/3VkwOwkn23oH+Tcwt7Uh2w:FtvYfYebIhHh2FUt8w/5/+w8/F5JfYeQ
MD5:	DC5DE90308ACFF817D086B7434C9B168
SHA1:	9206A3F7CD3523B9909C3F7C9AF178596CDB05AD
SHA-256:	3B6912D3B000E7011D98211BC512E0ABA175FB11E5DB9360E6A703981CBA31BC
SHA-512:	73ACC7C71C036963AF82326A305F65F7D7413F0287180412322052B66D7FAF0E09079F20F06EA808731DB91D7265FEBA7D3C1AAD66C00071F9AC8351379460C0
Malicious:	false
Preview:	2024/08/31-19:26:16.391 20b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-19:26:16.392 20b8 Recovering log #3.2024/08/31-19:26:16.481 20b8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulkL:Lst
MD5:	B71A3800BDE5ED784782CE73A71D849C
SHA1:	8F30B967D752BD287B3D4D848F95A642F59A890F
SHA-256:	26E8C028634B0CA99F913F0579973C33E1B6C7FAA97A9471CBF1D8D285D6E131
SHA-512:	EE5800249806185C883814DEC9EFF681B4AA2BC6655B6CFF68C40B3EF7FF34ACA0854D03017C91DA62DCF10EABAB318105A2F67B917CB29932874644E9CEE6B7
Malicious:	false
Preview:	...........................................Q../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlD8Tl:Ls3G
MD5:	EAFAD3FDA8FB31FD3B876CCF91D485B5
SHA1:	9AC42B76BC610259ECB1BEAE3128BB0DD9CE7541
SHA-256:	9F1DDA311E4986D3A99CD3A76222DEEC119D89010D347B59B50F621ED48DEC8F
SHA-512:	EE4139F5A70B1B73115E02C7DA5B7A5A8356D54B6F4E5B90CA205D4C5D51705E29D494F6AE966C2A8AC1AB4FCA39A079EB575D66974691CF83FF501869B7F4E1
Malicious:	false
Preview:	..........................................YQ../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.278979936949037
Encrypted:	false
SSDEEP:	6:GvqQ+q2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt8JqQgZmw+J3QVkwOwkn23oH+Tcd:GWvYfYebvqBQFUt8Q5/+G5JfYebvqBvJ
MD5:	71B52E61569D26BDC60175AE0B8B82F6
SHA1:	67EE57AA914AEA25AEAFBFB393D27C566232C7EE
SHA-256:	84555B912C14B653F20A7FD2B4B62B276F5AC014D35A04584B7DFD177A139A91
SHA-512:	73424BD2AB71AB43C14AA90D671AD118DC336F1E4CFD78B3FE6A85FFC9324929DD087C3B3709B6978447B8AA8CDCC5C9D718D5AE53D9C77774B892716616ECFB
Malicious:	false
Preview:	2024/08/31-19:26:17.400 288 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-19:26:17.401 288 Recovering log #3.2024/08/31-19:26:17.403 288 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.278979936949037
Encrypted:	false
SSDEEP:	6:GvqQ+q2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt8JqQgZmw+J3QVkwOwkn23oH+Tcd:GWvYfYebvqBQFUt8Q5/+G5JfYebvqBvJ
MD5:	71B52E61569D26BDC60175AE0B8B82F6
SHA1:	67EE57AA914AEA25AEAFBFB393D27C566232C7EE
SHA-256:	84555B912C14B653F20A7FD2B4B62B276F5AC014D35A04584B7DFD177A139A91
SHA-512:	73424BD2AB71AB43C14AA90D671AD118DC336F1E4CFD78B3FE6A85FFC9324929DD087C3B3709B6978447B8AA8CDCC5C9D718D5AE53D9C77774B892716616ECFB
Malicious:	false
Preview:	2024/08/31-19:26:17.400 288 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-19:26:17.401 288 Recovering log #3.2024/08/31-19:26:17.403 288 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\506f49a2-a12e-4a91-ada0-f929dc094c77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5070c605-1650-4d98-9bee-34a815735b66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3fd1e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e48a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ac82eb1c-f3af-4ab5-bf92-4ccd8a81c967.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b50a2806-002f-4ef4-9e69-e0b6b95e22ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.249766406665271
Encrypted:	false
SSDEEP:	12:P+vYfYebvqBZFUt8Q/+FnV5JfYebvqBaJ:0YfYebvyg8DJfYebvL
MD5:	EE1E4E80B5719DCF0107C1DC8AE7572A
SHA1:	1DE66E8A42100E627F0C0BE0240BCF072F5A3DE2
SHA-256:	16D4B189200C08F0CB17147CAE1578C61FFEC40BC4A34B99927E3791CB173A33
SHA-512:	69542F748FA8EAF27FB5D66EE9BBFD0114E1FFAA78C89AFB1901EEBDE08D9CFB3237F3C86403572AA8C21B12424F0C919E4D9AC42A4A25602DA2780C9A25DEBC
Malicious:	false
Preview:	2024/08/31-19:26:32.606 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-19:26:32.606 229c Recovering log #3.2024/08/31-19:26:32.609 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.249766406665271
Encrypted:	false
SSDEEP:	12:P+vYfYebvqBZFUt8Q/+FnV5JfYebvqBaJ:0YfYebvyg8DJfYebvL
MD5:	EE1E4E80B5719DCF0107C1DC8AE7572A
SHA1:	1DE66E8A42100E627F0C0BE0240BCF072F5A3DE2
SHA-256:	16D4B189200C08F0CB17147CAE1578C61FFEC40BC4A34B99927E3791CB173A33
SHA-512:	69542F748FA8EAF27FB5D66EE9BBFD0114E1FFAA78C89AFB1901EEBDE08D9CFB3237F3C86403572AA8C21B12424F0C919E4D9AC42A4A25602DA2780C9A25DEBC
Malicious:	false
Preview:	2024/08/31-19:26:32.606 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-19:26:32.606 229c Recovering log #3.2024/08/31-19:26:32.609 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.2546747743814635
Encrypted:	false
SSDEEP:	6:Flcm1M+q2Pwkn23oH+TcwtpIFUt8wlcmqZmw+wlcDMVkwOwkn23oH+Tcwta/WLJ:F5M+vYfYebmFUt8wW/+wIMV5JfYebaUJ
MD5:	9BFD5524A2B1C3370C26A52D9FA35778
SHA1:	F2A48E0EF257FA79DF79A1B4E2CCE0F1A0FFF365
SHA-256:	221A3F906C3DE566DB1B0CD2302184B2411F86528A127CFC77356D7CFB40BB68
SHA-512:	02B1BEDCD14E33BA6CDA3897C98E2970008B9B968875121FF89F9A13E1AB84E75B8368CD187B889B79CEE4C25F8F8B907510DB222FD22F584ECD34F8C71442E5
Malicious:	false
Preview:	2024/08/31-19:26:16.498 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-19:26:16.498 23fc Recovering log #3.2024/08/31-19:26:16.499 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.2546747743814635
Encrypted:	false
SSDEEP:	6:Flcm1M+q2Pwkn23oH+TcwtpIFUt8wlcmqZmw+wlcDMVkwOwkn23oH+Tcwta/WLJ:F5M+vYfYebmFUt8wW/+wIMV5JfYebaUJ
MD5:	9BFD5524A2B1C3370C26A52D9FA35778
SHA1:	F2A48E0EF257FA79DF79A1B4E2CCE0F1A0FFF365
SHA-256:	221A3F906C3DE566DB1B0CD2302184B2411F86528A127CFC77356D7CFB40BB68
SHA-512:	02B1BEDCD14E33BA6CDA3897C98E2970008B9B968875121FF89F9A13E1AB84E75B8368CD187B889B79CEE4C25F8F8B907510DB222FD22F584ECD34F8C71442E5
Malicious:	false
Preview:	2024/08/31-19:26:16.498 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-19:26:16.498 23fc Recovering log #3.2024/08/31-19:26:16.499 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746027
Encrypted:	false
SSDEEP:	3:Ul4Fl1lhtle:UOF3O
MD5:	15280AD0D1E7A9094B864E18C8F80C67
SHA1:	DE6060A4DAE6D4DA7FEB0978A795D927004AB0B5
SHA-256:	681477477F20563D12AC58D1DEE949518B7716E240CF99FA879AFE711A5504DD
SHA-512:	B5EAD742F7C58854D93393BC88F8BF9EB7CDE13ED46659395CAB3AF0E277F381C9835CAC3D921E83502A42F71902C0AAB57309DE8FEAF895D705BCEBD62447EE
Malicious:	false
Preview:	..............=....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b4e1bbf5-20ec-46e3-8265-ecc2c033eb25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c072d0e7-f0ed-4946-9362-e7cc246311e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.068305459729878
Encrypted:	false
SSDEEP:	96:sVGjqlLJ1jb9EBDYuX0dq8Y1sY5Th6Cp9/x+6M8muecmAeC3e4zvr72X6gE5AtE7:sV6YJ8DPwY1sYPpj+FVAr7FBf
MD5:	9340CBA6683D126CE32F107EDB0FA694
SHA1:	D48E8B2FF31F52EFCB5247235ADF5EAAC6E493D2
SHA-256:	32D7EFBAB7DBA190B288215D1D58A5F146177082EE456A74240FE2A45D594678
SHA-512:	4818F641DBA6141260731FD1F735221B3B3B03EBB49AD3F8447B4BBF3431E297C448585BE268A0B6FA62610412D58936740CA183C2EB4D2BD80E41192AD5BD15
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369620376524544","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fd97f140-bee9-4624-8861-aafba386d2c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557584518217631
Encrypted:	false
SSDEEP:	768:AOpIDq7pLGLv7CWPAqflA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8h7a6rw0zikpf8:AOpIDCcv7CWPAqflAu1jaNNa/0u4tO
MD5:	EBE350EFDC588C983947E866310AF4D8
SHA1:	189B4B21F204F9B272E9BBA71E23415596CAD639
SHA-256:	B7F79364094F8D8BE77B27BCC839D711478D0A2F7206C32022C1E28A5BE96EF0
SHA-512:	32B1A67F376FB310199B7937515529C56BF0E9C1868BD5A7C83AE5B789BDF7D71070560D03DC54C0AF4BA9E4D78E509F02ABFD997DCE3ADCC1528E0617F279ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620376392768","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620376392768","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.299328581908843
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxlhbm/ll3seGKT9rcQ6xOQYgEOtl:/XntM+4lIll3sedhOOyEO
MD5:	D7A222F03257829ED72A6565FF1C9846
SHA1:	FB2EA6DAAE3B8838EB0BA2132EE9754C2710CFBA
SHA-256:	9B92C5CC1FEAAE5D11AC346A4446576D64E0F00268C362BE13BC0283A0734A70
SHA-512:	3D68598D55B812D3B6A18682BE7EB965F7734B5887EABBF824F22872EDBBE1BBA7CBDA5994C600E1A0DA61EAC36FEB0EE07B5C1C7DC67A89EF01A4604C6F5567
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................<{0................39_config..........6.....n ...1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.261380222882316
Encrypted:	false
SSDEEP:	6:FUmq1wkn23oH+Tcwtfrl2KLlH0cS39+q2Pwkn23oH+TcwtfrK+IFUv:F31fYeb1LtfS39+vYfYeb23FUv
MD5:	D97122534CADD13D9C97C52D94874A69
SHA1:	EDAC3A494E62249103B00AC7972C8CF11506D4B4
SHA-256:	2C079688019099693158EB444543723A5C5F7EE7903F08D9A398B8B367C7EB36
SHA-512:	A1A26CDAD5920E9536F01DBE09813402A7560E72937CF1EA86A79F0BD9CFE9F7CFFB9CFAE3996143F44AAB86F838839D97C7D99E7F0F383A6D2262575AC98ED0
Malicious:	false
Preview:	2024/08/31-19:26:16.544 209c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/31-19:26:16.702 209c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.216852493485129
Encrypted:	false
SSDEEP:	6:F5Rq1wkn23oH+Tcwtfrzs52KLlH8OOq2Pwkn23oH+TcwtfrzAdIFUv:F5R1fYebs9LtXOvYfYeb9FUv
MD5:	FE9506048392977B57DAEDE4F8491B05
SHA1:	7C096298409EEDE2BCB573E3F8141A61B9B8FE43
SHA-256:	37F43C0D0C8C199C036B41C16FAAF23C6A870B86F5D18EA7354EE46BADE7C7CA
SHA-512:	51FCD455DD2BC26D7E7F65C0244AF0E7FD25DB7F37A47D3589B3A0B55258ECAE3E3139357FED473818BD39A65C6F153B8E83C3837B697A29C60591A713A7DA3D
Malicious:	false
Preview:	2024/08/31-19:26:16.514 23f0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/31-19:26:16.531 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlkPl:Ls3w
MD5:	6E17914CBF6984D8B9A96F215F03E7D6
SHA1:	269A0909867929B67D97CB0703F4F1D38E0E2FA2
SHA-256:	A8D8AFBD7F95766A9368E9A7E7957F63FF899E9CFCD81765ED737FCE75B34C33
SHA-512:	9C8A669A7C8E07F8DA5D5E0A19DFCC0159BB12FDDC2ACE1975CEF7E75C42BE61F75B23899F8760E60F137949D759B3064E5BD9DA3E20714D95971433932D6717
Malicious:	false
Preview:	........................................E.`Q../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlzQ:Ls3k
MD5:	D7085E4ADC544E7CC60AB6364678DD0C
SHA1:	A62D294473E3CAAA80DCBC07751AF25A4BC6683F
SHA-256:	F5FAD58FF0E08720726954D5E21E1320B9C3DAD91BC47BB6769C75D7AD910034
SHA-512:	99C3DF8BE466DC0EFE69344D56BD0ADBE074CADA12BA386F0696B105EAA7BDB0627A7E48D94DCBFA846711BB7BBEDE8DD0A3649CE43BE0576EC098B6E8BB2281
Malicious:	false
Preview:	..........................................aQ../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d269.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f199.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f1e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f1f7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31250.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31260.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF345d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bbfe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e31e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40a2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43332.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793161853576785
Encrypted:	false
SSDEEP:	96:iaqkHfQLrb5ih/cI9URLl8RotoBMFVvlwhge4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ako38eiRUOhA6qRAq1k8SPxVLZ7VTiq
MD5:	0452B99B462F9D489566D748A5592648
SHA1:	EFBBC0BB909ECF1E6B73FABFFA646B87F098E581
SHA-256:	335F0FA917E3D3F94B6C9CB8546DD3E29D63721A3E4DD951B6B9A6BA9A1F5BF5
SHA-512:	DAF5B154F6181A0904A6BFBE7A864CE55A57C9963279A66B154410A9D616E429AE38BAD256B1F94B8D28E7A2C3A8E92738887073B1AFE7F8C180F827ABE38F6D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAUB6EsvPZoS5CCuIs1jTBQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABSuVSE6fxoCM00VRlBM7XBZbyycChfM9kU+ze6pcY+mAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlO+:Ls3O+
MD5:	05AEF25E3A793546B7300C10533936AA
SHA1:	4FFFE9B8A2BA7DB2B755DA8123EF075F9A5EE3E1
SHA-256:	DF6A03D4E92370F3E2E0A179440C207FB1D20E8351FAD806695C71EF183DD455
SHA-512:	B69BC9397F94E0BA55DF3FD9F6C1EE3C73358763A2CCB46697D2D7EE779EDC0E82581A050B168DED1FFF5DE743B137916F46668E4716E4415E6B55DBC0CF0DBE
Malicious:	false
Preview:	..........................................SQ../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a6542511-ab2f-4082-ae01-8db199af1171.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24700
Entropy (8bit):	6.052841049600819
Encrypted:	false
SSDEEP:	768:gMGQ7FCYXGIgtDAWtJ4nr3wNznGh02tdj:gMGQ5XMBGUNzyr
MD5:	0B7AA5C15B1FB5475E0555194C4CAB88
SHA1:	085C439FFD2DEC444FF7B0B92464D1CF079516A0
SHA-256:	4E8B3053E86CB18228D947E5801B45FB6A3078D12CCA343049A15FF63255E862
SHA-512:	A5DE778F317B8F8F8ADD23D8B5DFF6CA7FC4012E8EF57F1D022CF97FF978FF123CECA9C11279E62933B7B450240269612F75FE43FE6823DFA8E1B6795623CBD9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369620376543077","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b00010bc-f3c7-48e9-9f4d-24530f80467a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.804618689681601
Encrypted:	false
SSDEEP:	192:fsNAo3ReiRUufQpkAaC6qRAq1k8SPxVLZ7VTiQ:fsNAg946AaC6q3QxVNZTiQ
MD5:	1546D8AD7E57356AC109046AC5E55270
SHA1:	23C955210CBD6BE14C6070F770AF7CEC627776AD
SHA-256:	95706B6D83D679454D7B54CDFC2AAEE1C4EC6C9D6C93C156F92DBCA34A640439
SHA-512:	E56BBA7C7C991DEB1098B15CBD32A14AAA86E0C0B9E6CB3771E43A58BD74DB9563D47FE3FA519599D72DB995460835CC10DD15B1BADC60A17616AD88FD1EB1A1
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bb07e2fd-43d4-4c43-a6d4-c6fa2a6e174d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833357189007831
Encrypted:	false
SSDEEP:	192:fsNwo3ReiRUT819Q5Sw1SkAa796qRAq1k8SPxVLZ7VTiB:fsNwgi8O5TRAa796q3QxVNZTiB
MD5:	E3765F1ED273A4E9313341C85F150AA3
SHA1:	98001B2395694721273B89A6D8CA07A6E1F1C11B
SHA-256:	35456098DA48269DB8F9C6356562B60F005298FDDCC5A0BCA97052DF7413EB2D
SHA-512:	158B8E81E8BF0839A070666167ACFC01B484536780998DBE51A4A77064CBD60113E892107773E3FEDCD2CE4A42A4C220AE0C840C4725EC17EC691C8E6DB1825A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8416252949334617
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxVxl9Il8u1+n1JdiugpEmEaQT09ZEbKd1rc:mQYKZJRaQY9abJ
MD5:	E1E9F5A152A0338B410BE61781FFBBC0
SHA1:	A358EAD5635A92F9364C415DAB3474DD514E66D9
SHA-256:	9F8938AEBCB2018DACA3F6F3A739E5F034D4C2ED58D664FA4BC0EEC446375648
SHA-512:	2C3AD6064E4A2BDDAE5EAA562FA2DF1ADEDFAB57C989AC0CB98D7DBBA2AC0FD9FB161A8F644CDB0E8D42D2EE42464988D1B7B6408DEC6446E7A75562F08FD5B5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.w.p.h.Q.X.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.A.e.h.L.L.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005113633334885
Encrypted:	false
SSDEEP:	96:lY+O3ChafPT7rD6QcX9k/2NAPLylyxd6jGQZ:lzO3ChaHvr5cSMAPRL41Z
MD5:	5764BB1382C3985C0F873149623AA084
SHA1:	CA55A756CEFEEF599751F4E11F04C8A057F0B340
SHA-256:	110F468E75D2B7CD5790774369562D9AF7C3D5959A1A8126630FBF95DD6217B7
SHA-512:	4DB4F20B19C324CF2996D3A0B935496B6095CE34E63018929BADCB05675AE3EE413527D2A8DB9085546E2F33C435BE4ED2B596C1390F3CFFCAE6B26B791D40B6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Y.t.o.g.a./.3.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.A.e.h.L.L.

C:\Users\user\AppData\Local\Temp\5e0b2c98-fd8a-46b4-97f5-9ab3c5dafc65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7f88bc31-0c42-4289-8b1f-24ba851e3ca2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8fbd174d-c7c3-47e9-a98c-cb26a804135f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.376295803095833
Encrypted:	false
SSDEEP:	12:YpEkMmxu0Dkv/PEyR4rnL56s/PEyR7n0Dkv/PEyRtQw56s/C:YpAmxu08PuL5xP708P35M
MD5:	D1577D34B2F2B32F237DE693B7EC5BED
SHA1:	AD5D20FAF57BA38812EE9951EDFBC13C1D4C046D
SHA-256:	7590C47605800FE876EFC4959A0F7BEBFC142A0FEA32D16F08F664AB4B7916C3
SHA-512:	8CB75C8BD6FF75FF89AB51CFF7A26A3FB294F8D09E7605FC2A471645CCCD03ED0343C04C51CACB1D1CD9A1EFF4AB605AB07F8C5ECB6D90E5E394CDC16B61CC8E
Malicious:	false
Preview:	{"logTime": "0831/232602", "correlationVector":"F51AEFC7BA46457AA5F0FEE65B876946","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/232618", "correlationVector":"Ws1MXQjdtG+PEVHM9dhL8R","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0831/232618", "correlationVector":"4CCA5E87D3314591B955686AEF384DD5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/232618", "correlationVector":"/bSlhs2Ia+3LIbDXlJtrHi","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\f70ef61b-b90b-4245-bea7-31e176816acf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_1456613435\7f88bc31-0c42-4289-8b1f-24ba851e3ca2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir9088_1456613435\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9088_1456613435\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9088_1456613435\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9088_1456613435\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\8fbd174d-c7c3-47e9-a98c-cb26a804135f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9088_866148050\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5237527279294523
Encrypted:	false
SSDEEP:	48:vEtOdOwzVsJmrJzBdLXuHVkDpJ2A5zdOw4VsJmrJzngdLXuHVk+21:v3u1kDCnnIu1kz
MD5:	5A6BEB78BEE4E17CCB871EC9D4F5A463
SHA1:	CCA4762C118DA243F99A5A89B95A53DB2FF05A96
SHA-256:	816CD21084BA5B188632D16EEC70D6EF62E3469831166FBA2718846A9C30F764
SHA-512:	C5D6D9A874E8CCC0B4C6E83875B1EA351AEA63384CEF23C07097E1B12734A62AC50E852FA1240B4E5B0B528E0F5B3EFAC43DFE60CEC4608D4ACBEB4123216C16
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......$.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.....$.X.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y=..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y=...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y=.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I9PRC721EAAP6P91ACIH.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5237527279294523
Encrypted:	false
SSDEEP:	48:vEtOdOwzVsJmrJzBdLXuHVkDpJ2A5zdOw4VsJmrJzngdLXuHVk+21:v3u1kDCnnIu1kz
MD5:	5A6BEB78BEE4E17CCB871EC9D4F5A463
SHA1:	CCA4762C118DA243F99A5A89B95A53DB2FF05A96
SHA-256:	816CD21084BA5B188632D16EEC70D6EF62E3469831166FBA2718846A9C30F764
SHA-512:	C5D6D9A874E8CCC0B4C6E83875B1EA351AEA63384CEF23C07097E1B12734A62AC50E852FA1240B4E5B0B528E0F5B3EFAC43DFE60CEC4608D4ACBEB4123216C16
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......$.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.....$.X.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y=..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y=...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y=.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OHSW5UYIO8MAINXC1JMG.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5195721915448033
Encrypted:	false
SSDEEP:	48:vE5zdOw4VsJmrJzBdLXuHVkDpJ2A5zdOw4VsJmrJzngdLXuHVk+21:73u1kDCnnIu1kz
MD5:	24033735E4F6C4D82A22A46BAA84D01F
SHA1:	C8081C5506C3BC1FECEDC79B64E03EF33F98A5CE
SHA-256:	E1A5984048E023ACB6309B6FA14A993C24CBE16E9D2B65A1163DBF902111B2E4
SHA-512:	A068F3B0916DB4C125A972D8B3D9731C7A370BA58DF96F028520FB592A27BB6CA68EEE58B5B25362164230F5EE9DA5169F85AE9BBAF1D479B38A7A26B474258C
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......$.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y:...PROGRA~2.........O.I.Y:.....................V.......R.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y=..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..YB............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y=...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y=.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5195721915448033
Encrypted:	false
SSDEEP:	48:vE5zdOw4VsJmrJzBdLXuHVkDpJ2A5zdOw4VsJmrJzngdLXuHVk+21:73u1kDCnnIu1kz
MD5:	24033735E4F6C4D82A22A46BAA84D01F
SHA1:	C8081C5506C3BC1FECEDC79B64E03EF33F98A5CE
SHA-256:	E1A5984048E023ACB6309B6FA14A993C24CBE16E9D2B65A1163DBF902111B2E4
SHA-512:	A068F3B0916DB4C125A972D8B3D9731C7A370BA58DF96F028520FB592A27BB6CA68EEE58B5B25362164230F5EE9DA5169F85AE9BBAF1D479B38A7A26B474258C
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......$.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y:...PROGRA~2.........O.I.Y:.....................V.......R.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y=..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..YB............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y=...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y=.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579760957810958
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	d6f5bca2f2ce2407ae4bf9115cfca6d9
SHA1:	9bf709a5fb7d18fb70f15fab8aeb352b0d7b9aaf
SHA256:	33955cbc4fdce5f71691408a1431b76b8fd40cdfde91f8ea3724dc7414885c15
SHA512:	15d73b3b2ef63ee160724220e3d112f3fd3c09a00cecfe7672570f0763505ca1fb4e79d963fdfb0f263d51e8f2d0b8596058b960bdb37017a6a941d0543d13f8
SSDEEP:	12288:MqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTB:MqDEvCTbMWu7rQYlBQcBiT6rprG8asB
TLSH:	F7159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D3A43F [Sat Aug 31 23:16:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F7854DE8053h
jmp 00007F7854DE795Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F7854DE7B3Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F7854DE7B0Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F7854DEA6FDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F7854DEA748h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F7854DEA731h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	b1747b27f27fd3632ba081f530377d17	False	0.286953125	data	5.1652440674890565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 01:25:52.050936937 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 1, 2024 01:26:01.690197945 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 1, 2024 01:26:03.291683912 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.291696072 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:03.291826963 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.292206049 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.292213917 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:03.983364105 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:03.991439104 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.991447926 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:03.992322922 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:03.992377043 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.994549036 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.994604111 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:03.995029926 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:03.995037079 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.000355959 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.000386953 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.000672102 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.001027107 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.001038074 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.093090057 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.093132973 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.093198061 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.093198061 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.093210936 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.093415976 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.093467951 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.144764900 CEST	49747	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.144784927 CEST	443	49747	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.591662884 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:04.591708899 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:04.591766119 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:04.592021942 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:04.592031002 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:04.592597961 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.592606068 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:04.592711926 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.592834949 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.592844009 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:04.592921019 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.592982054 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.592992067 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:04.593146086 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.593153000 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:04.593456030 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.593480110 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:04.593544960 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.593717098 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:04.593729019 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:04.659969091 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.660310984 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.660321951 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.660681963 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.660960913 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.661024094 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.661113977 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.708045959 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:04.708065033 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:04.708149910 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:04.708499908 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.709100008 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:04.709110975 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:04.767637014 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.767657042 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.767672062 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.767725945 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.767736912 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.767781973 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.856934071 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.856956959 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.856997013 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.857012033 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.857037067 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.857055902 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.858772039 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.858789921 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.858841896 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.858848095 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.859045982 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.946454048 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.946476936 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.946512938 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.946518898 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.946530104 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.946577072 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.946594954 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.946594954 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:04.946667910 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.948129892 CEST	49749	443	192.168.2.4	13.107.246.57
Sep 1, 2024 01:26:04.948143959 CEST	443	49749	13.107.246.57	192.168.2.4
Sep 1, 2024 01:26:05.049361944 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.049586058 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.049597979 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.050575018 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.050640106 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.050807953 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.051259041 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.051280975 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.051683903 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.051739931 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.051897049 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.051906109 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.051940918 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.052118063 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.052124977 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.052541971 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.052726984 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.052732944 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.053319931 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.053386927 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.053483009 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.053531885 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.054395914 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.054496050 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.054634094 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.054693937 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.055262089 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.055367947 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.055373907 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.055463076 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.055597067 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.055650949 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.055660963 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.055676937 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.055845022 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.055850983 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.096450090 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.096515894 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.115519047 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.115519047 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.175432920 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.175436020 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.175487995 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.175496101 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.175532103 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.175681114 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.175684929 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.175739050 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.175785065 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.176096916 CEST	49750	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.176112890 CEST	443	49750	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.176544905 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.176553965 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.176759958 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.176779032 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.177083969 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.177360058 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.177370071 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.178220987 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.178275108 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.179600000 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.179656029 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.179784060 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.179795980 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.183414936 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.183469057 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.183578014 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.183634996 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:05.183640957 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:05.237095118 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.293545008 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.293593884 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.293649912 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.294075966 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:05.294090033 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:05.767138958 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:05.767168999 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:05.767338037 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:05.769645929 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:05.769655943 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.406511068 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.406577110 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.412209988 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.412220955 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.412467957 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.459942102 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.526750088 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.529542923 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.529567957 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.529625893 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.529843092 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.529849052 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.529918909 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.532856941 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.532869101 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.533076048 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.533086061 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.572499037 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.711144924 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.711209059 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.712538958 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.897284985 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.897305965 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.897392988 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.897401094 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.932024956 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.932046890 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.932111979 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.933046103 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:06.933058023 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:06.991580009 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.992944956 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.992954016 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.993274927 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.993662119 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.993719101 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.994034052 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.994529963 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.994537115 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.994823933 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.995367050 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.995409966 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.041912079 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.042007923 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.179490089 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.179517031 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.179759979 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.179964066 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.179989100 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.180044889 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.180295944 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.180310011 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.180485010 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.180499077 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.484047890 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.484061956 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.484143972 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.484361887 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.484374046 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.567044020 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.567111969 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:07.568331003 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:07.568341017 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.568584919 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.569719076 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:07.612507105 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.642925024 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.646114111 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.646126032 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.646523952 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.646589041 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.647214890 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.647270918 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.648890018 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.648956060 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.649441004 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.649446964 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.667556047 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.667823076 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.667831898 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.668196917 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.668250084 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.668915987 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.668965101 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.669224977 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.669290066 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.669559956 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.669568062 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.692538977 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.724129915 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.756968975 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.757138014 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.757297993 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.757740974 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.757750034 CEST	443	49764	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.757759094 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.757834911 CEST	49764	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.786467075 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.786562920 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.786612988 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.787051916 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.787061930 CEST	443	49765	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:07.787070036 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.787113905 CEST	49765	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:07.843128920 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.843189955 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.843252897 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:07.844368935 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:07.844386101 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.844400883 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 1, 2024 01:26:07.844407082 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 1, 2024 01:26:07.944585085 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.945126057 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.945137978 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.945983887 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.946039915 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.947338104 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.947390079 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.947999954 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:07.948005915 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:07.988220930 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:08.042831898 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.042885065 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.042911053 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.042942047 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.042958021 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:08.042967081 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.042978048 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:08.043042898 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.043087006 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:08.043925047 CEST	49766	443	192.168.2.4	142.250.72.100
Sep 1, 2024 01:26:08.043932915 CEST	443	49766	142.250.72.100	192.168.2.4
Sep 1, 2024 01:26:08.067186117 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.067200899 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.067261934 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.067480087 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.067492008 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.098738909 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.098747015 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.098879099 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.099112988 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.099123955 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.526184082 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.526477098 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.526489973 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.526906013 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.527101040 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.527591944 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.527657032 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.527959108 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.528024912 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.578239918 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.580992937 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.580992937 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.581001043 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.581015110 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.581393957 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.581520081 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.582107067 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.582240105 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.582421064 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.582482100 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.621402025 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.636075020 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.636080980 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.683193922 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:14.225992918 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:14.226039886 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:14.226128101 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:14.227355957 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:14.227370024 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:15.035944939 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:15.036389112 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:15.039150000 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:15.039160013 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:15.039477110 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:15.080879927 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:15.758481979 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:15.804505110 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025134087 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025151014 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025156975 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025166988 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025194883 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025221109 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.025249958 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025263071 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.025293112 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.025680065 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.025734901 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.025742054 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.026052952 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.026148081 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.727075100 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.727093935 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:16.727111101 CEST	49769	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:16.727116108 CEST	443	49769	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:19.689740896 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:19.689774036 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:19.689840078 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:19.690067053 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:19.690077066 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.072460890 CEST	80	49723	41.63.96.0	192.168.2.4
Sep 1, 2024 01:26:20.072613955 CEST	49723	80	192.168.2.4	41.63.96.0
Sep 1, 2024 01:26:20.072940111 CEST	49723	80	192.168.2.4	41.63.96.0
Sep 1, 2024 01:26:20.077665091 CEST	80	49723	41.63.96.0	192.168.2.4
Sep 1, 2024 01:26:20.372653961 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:20.372678041 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:20.372734070 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:20.372947931 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:20.372961044 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:20.407640934 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.407903910 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.407917976 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.408235073 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.408246040 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.408291101 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.408298969 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.408337116 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.408845901 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.410259962 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.410320997 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.410446882 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.452513933 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.455749989 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.455769062 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.502609968 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.673919916 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.673953056 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.674010038 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.674032927 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.676898003 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.677001953 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.677018881 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.683201075 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.683262110 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.683283091 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.689440966 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.689498901 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.689521074 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.695765018 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.695831060 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.695849895 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.702016115 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.702068090 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.702078104 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.708508968 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.708652020 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.708669901 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.714562893 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.714613914 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.714622021 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.760411978 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.760466099 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.760478973 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.763281107 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.763334990 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.763341904 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.769655943 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.769722939 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.769728899 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.775891066 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.775950909 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.775958061 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.782299995 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.782350063 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.782358885 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.788465977 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.788577080 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.788584948 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.794842005 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.794894934 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.794902086 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.801217079 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.801290989 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.801301003 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.807286024 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.807329893 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.807336092 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.813117027 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.813158035 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.813164949 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.818612099 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.818664074 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.818670988 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.823990107 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.824054956 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.824062109 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.829499960 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.829550028 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.829555035 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.834880114 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.834934950 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.834942102 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.840367079 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.840425014 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.840431929 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.845793962 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.845854998 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.845860958 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.851248980 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.852442980 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.852451086 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.855226040 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.855283022 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.855289936 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.859096050 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.859138012 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.859144926 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.862720966 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.862780094 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.862788916 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.866364956 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.866468906 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.866473913 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.869884968 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.870445967 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.870455980 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.873320103 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.873423100 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.873430014 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.876869917 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.878007889 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.878015041 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.880356073 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.880611897 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.880620003 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.883862972 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.883905888 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.883913994 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.887265921 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.888448954 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.888454914 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.890786886 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.890888929 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.890897989 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.899002075 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.899029970 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.899054050 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.899058104 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.899065971 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.899090052 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.901225090 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.901442051 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.901449919 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.904757977 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.906445980 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.906455040 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.908126116 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.908242941 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.908252001 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.911643028 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.911706924 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.911715031 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.915178061 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.915455103 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.915462017 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.918587923 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.918636084 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.918643951 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.921972036 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.924443960 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.924452066 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.925249100 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.926369905 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.926382065 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.928502083 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.928554058 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.928560972 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.931582928 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.931610107 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.931633949 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.931647062 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.931791067 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.934618950 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.937661886 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.937724113 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.937731028 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.937808990 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.937922955 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.937932014 CEST	443	49782	142.250.186.161	192.168.2.4
Sep 1, 2024 01:26:20.937954903 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:20.937989950 CEST	49782	443	192.168.2.4	142.250.186.161
Sep 1, 2024 01:26:21.044490099 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.045202017 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.045226097 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.046498060 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.046562910 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.047686100 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.047744989 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.047856092 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.047863007 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.150243998 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.150298119 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.150335073 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.150345087 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.150396109 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.150686979 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.150747061 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.150881052 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.152318001 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.152328968 CEST	443	49785	13.107.246.60	192.168.2.4
Sep 1, 2024 01:26:21.152354956 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.152410984 CEST	49785	443	192.168.2.4	13.107.246.60
Sep 1, 2024 01:26:21.900338888 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:21.900412083 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:21.900466919 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:21.903877020 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:21.903933048 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:21.903980017 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.030219078 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.030247927 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.030371904 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.030615091 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.030627012 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.031172037 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.031177998 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.031234980 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.031527042 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.031537056 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.148317099 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.148338079 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.148441076 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.149167061 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.149185896 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.503035069 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.503088951 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.503407001 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.503418922 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.503621101 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.503628016 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.504273891 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.504323959 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.504487038 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.504523993 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.506427050 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.506478071 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.506757975 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.506763935 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.507064104 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.507116079 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.507280111 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.507286072 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.551320076 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.624768972 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.624823093 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.625085115 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:23.625098944 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:23.625252962 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.625294924 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.625415087 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.625637054 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.625641108 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.638782978 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.638981104 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.638999939 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.639853954 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.639904022 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.640870094 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.640924931 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.641056061 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.688497066 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.782310963 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:23.782363892 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.782737970 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:23.782747030 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:34.916421890 CEST	80	49724	217.20.57.19	192.168.2.4
Sep 1, 2024 01:26:34.916539907 CEST	49724	80	192.168.2.4	217.20.57.19
Sep 1, 2024 01:26:34.916610003 CEST	49724	80	192.168.2.4	217.20.57.19
Sep 1, 2024 01:26:34.921469927 CEST	80	49724	217.20.57.19	192.168.2.4
Sep 1, 2024 01:26:38.095216036 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.095247030 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.095448017 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.095726967 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.095752954 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.095808983 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.095946074 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.095961094 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.096203089 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.096215010 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.576168060 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.576497078 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.576632023 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.576646090 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.576941967 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.577558041 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.577574968 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.577861071 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.577908039 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.577920914 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.578543901 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.578605890 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.627696991 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.627970934 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.698723078 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:38.698756933 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:38.698832989 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:38.699065924 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:38.699079990 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.255755901 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.257194996 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.257215023 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.258063078 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.258116961 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.259458065 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.259514093 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.259742975 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.259749889 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.300717115 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.357098103 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.357549906 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.357558012 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.357593060 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.357604027 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.357630014 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.357673883 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.358419895 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 1, 2024 01:26:39.358442068 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 1, 2024 01:26:39.655492067 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.655529022 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:39.655824900 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.655890942 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.655898094 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:39.656013012 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.656280041 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.656292915 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:39.656624079 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.656632900 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.108889103 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109349012 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.109364033 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109642982 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109950066 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.110009909 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.110980034 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.127537966 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.127748013 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.127754927 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.128077984 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.128417015 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.128472090 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.152498960 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.175088882 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.246241093 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.246292114 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.246474028 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.246682882 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.246700048 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:53.292387962 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:53.292428970 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:53.292505026 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:53.292933941 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:53.292953014 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:53.459989071 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:53.460047960 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:53.460167885 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:53.466228962 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:53.466295004 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:53.466347933 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:53.596333981 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:53.596350908 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:53.643208027 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:53.643214941 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:54.077496052 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.077570915 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.081680059 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.081692934 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.081898928 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.092374086 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.132499933 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.410587072 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.410607100 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.410621881 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.410665035 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.410676003 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.410686970 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.410715103 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.411885977 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.411921024 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.411945105 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.411948919 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.411957026 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.411973000 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.411992073 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.415291071 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.415304899 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:54.415317059 CEST	49797	443	192.168.2.4	20.114.59.183
Sep 1, 2024 01:26:54.415322065 CEST	443	49797	20.114.59.183	192.168.2.4
Sep 1, 2024 01:26:55.034986019 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:55.035060883 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:55.035161018 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555187941 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555233955 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:59.555291891 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555423021 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555454969 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:59.555502892 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555639982 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555650949 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:59.555775881 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.555789948 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.053667068 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.053796053 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.053944111 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.053962946 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.054255962 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.054320097 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.054336071 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.054503918 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.054563046 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.054624081 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.054847002 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.054938078 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.098685980 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.098685980 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:06.907768965 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:06.907768965 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:06.907798052 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:06.907809019 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:14.970969915 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:14.970979929 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:14.971044064 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:14.971054077 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:14.971096992 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:14.974895000 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:17.396445990 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:17.396467924 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:38.475028038 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:38.475055933 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:38.475078106 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:38.475116968 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:38.600070953 CEST	49767	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:27:38.600080967 CEST	443	49767	142.250.81.238	192.168.2.4
Sep 1, 2024 01:27:38.645137072 CEST	49768	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:27:38.645160913 CEST	443	49768	142.250.81.238	192.168.2.4
Sep 1, 2024 01:27:51.910518885 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:51.910547972 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:51.910582066 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:51.910587072 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:59.972254992 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:59.972294092 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:59.987863064 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:59.987881899 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 1, 2024 01:28:01.730427980 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:01.730458975 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:01.730514050 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:01.730703115 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:01.730731010 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:01.730782986 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:01.730902910 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:01.730914116 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:01.731020927 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:01.731033087 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.184803009 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.185018063 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.185029030 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.185338020 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.185683966 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.185739994 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.191272974 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.191471100 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.191482067 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.191798925 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.192145109 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.192212105 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.237096071 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.238141060 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.274528980 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.274610996 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.274698973 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.274873018 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.274909973 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.769422054 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.770776987 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.770824909 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.771156073 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.774910927 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.774981022 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.775078058 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.816500902 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.817862034 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.917536974 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.917562008 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.917630911 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.917659044 CEST	443	49804	23.43.85.147	192.168.2.4
Sep 1, 2024 01:28:02.917862892 CEST	49804	443	192.168.2.4	23.43.85.147
Sep 1, 2024 01:28:02.917901993 CEST	49804	443	192.168.2.4	23.43.85.147

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 01:26:00.047221899 CEST	53	56992	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:01.745697975 CEST	52622	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:01.749327898 CEST	51188	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:02.992532969 CEST	53	55290	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:03.003207922 CEST	53	63517	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.584192038 CEST	56007	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.584491014 CEST	62658	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.585063934 CEST	62366	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.585196018 CEST	64014	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.585441113 CEST	59109	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.585573912 CEST	59882	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.586023092 CEST	56649	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.586153984 CEST	64864	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.590908051 CEST	53	56007	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.591224909 CEST	53	62658	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.591793060 CEST	53	62366	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.591803074 CEST	53	64014	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.591856003 CEST	53	59109	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.591922998 CEST	53	59882	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.592567921 CEST	53	64864	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.593009949 CEST	53	56649	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.700618982 CEST	57135	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.700941086 CEST	57132	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:04.707276106 CEST	53	57135	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:04.707681894 CEST	53	57132	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:06.212213993 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.529150963 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.671461105 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.671472073 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.671513081 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.671523094 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.671538115 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.710726023 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.813908100 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.866223097 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.866406918 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.872880936 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.872999907 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.960216045 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.960225105 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.960228920 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.960232019 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.967356920 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.968060017 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.968234062 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:06.981796026 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.982043028 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:06.982203007 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.082982063 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.083091021 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.084471941 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.119594097 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.177937031 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.178482056 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.178682089 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.179033995 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.387658119 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.387784004 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.482362986 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.482881069 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.483006001 CEST	443	57370	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:07.483649969 CEST	57370	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:07.759639025 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.066792965 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.229460001 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.229474068 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.233659029 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.236401081 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.236413002 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.236423016 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.236428976 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.236671925 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.236671925 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.238363981 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.239175081 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.239291906 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.239676952 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.239845037 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.337902069 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.338382006 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.338391066 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.342402935 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.352616072 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.353666067 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.354525089 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:08.358396053 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:08.456091881 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:16.026129961 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:16.026174068 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:16.124327898 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:16.150885105 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:16.151351929 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:16.151640892 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:16.190876961 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:16.274384975 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:19.670993090 CEST	50326	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:19.671139956 CEST	58892	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:19.677848101 CEST	53	50326	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:19.689182043 CEST	53	58892	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:20.825707912 CEST	138	138	192.168.2.4	192.168.2.255
Sep 1, 2024 01:26:21.975044966 CEST	53	60167	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:23.021754980 CEST	63620	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:23.022027969 CEST	55246	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:23.022413015 CEST	64581	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:23.022602081 CEST	49180	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:23.028558016 CEST	53	55246	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:23.028795004 CEST	53	64581	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:23.029210091 CEST	53	49180	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:23.029561043 CEST	53	63620	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:23.140616894 CEST	57549	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:23.140856028 CEST	59296	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:26:23.147320032 CEST	53	57549	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:23.147589922 CEST	53	59296	1.1.1.1	192.168.2.4
Sep 1, 2024 01:26:37.167428017 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.167474031 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.265783072 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:37.279357910 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:37.279622078 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.279937029 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:37.316618919 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.403291941 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:37.857913017 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.858294010 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.943223953 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.943501949 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.956382990 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:37.970264912 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:37.970494032 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:37.970668077 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:38.003765106 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:38.045871019 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:38.059489965 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:38.059947968 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:38.094404936 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:38.094858885 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.109246969 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:38.145699978 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:38.224102020 CEST	443	60957	142.250.81.238	192.168.2.4
Sep 1, 2024 01:26:38.235970974 CEST	60957	443	192.168.2.4	142.250.81.238
Sep 1, 2024 01:26:38.427627087 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.574129105 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.574152946 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.574172974 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.574186087 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.574805021 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.577053070 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.577301979 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.578214884 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.578372002 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.666148901 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.672765017 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.672791004 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.672800064 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.672806978 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.673258066 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.673348904 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.675045013 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.676611900 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.697933912 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.698210001 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:38.768847942 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:38.800384998 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:39.653850079 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:39.653850079 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:39.655009985 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:39.750602961 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:39.751425028 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:39.751547098 CEST	443	59282	172.64.41.3	192.168.2.4
Sep 1, 2024 01:26:39.752048969 CEST	59282	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:26:39.956717968 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.109813929 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109831095 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109841108 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109849930 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.109860897 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.110991955 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.112081051 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.112334967 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.112468958 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.207216978 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.207227945 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.207240105 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.207247972 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.207576036 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.207683086 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.208175898 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.209178925 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.238094091 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:40.302804947 CEST	443	60016	162.159.61.3	192.168.2.4
Sep 1, 2024 01:26:40.339762926 CEST	60016	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.554936886 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:26:59.903511047 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.051292896 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.051307917 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.051321030 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.051330090 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:00.052041054 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.053644896 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.053735018 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.054119110 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.054219007 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.567814112 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.567862988 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.568226099 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:00.568262100 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:01.052025080 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:01.085184097 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.175474882 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.180402994 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.180416107 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.180901051 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:01.181010962 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.181020975 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.181193113 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:01.275088072 CEST	443	59931	162.159.61.3	192.168.2.4
Sep 1, 2024 01:27:01.301367998 CEST	59931	443	192.168.2.4	162.159.61.3
Sep 1, 2024 01:27:09.196408033 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.199428082 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.202722073 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.202866077 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.629319906 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.644347906 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.644800901 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.675381899 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.727153063 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.727164030 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.727170944 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.727179050 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.727421045 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.727483034 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.742218971 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.769023895 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.824868917 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.825081110 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.923624039 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.924195051 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.924617052 CEST	443	58748	172.64.41.3	192.168.2.4
Sep 1, 2024 01:27:09.924746037 CEST	58748	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:27:09.925681114 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:09.926103115 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.301495075 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.380820036 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.380832911 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.381532907 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.381644011 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.381896019 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.381906033 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.382015944 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.382028103 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.395018101 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.395191908 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.477322102 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.477525949 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.477610111 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.477751970 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.478219032 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.478557110 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.478682041 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.488651037 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.491763115 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.491941929 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.492058039 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.494276047 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:10.494550943 CEST	54390	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:10.588108063 CEST	443	54390	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.148212910 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.148360014 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.613445044 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.613471031 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.617413044 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.617448092 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.617641926 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.618587971 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.618621111 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.618643045 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.631129026 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.712410927 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.713124990 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.713182926 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.713191032 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.713315964 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.728507996 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.728672028 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.728780031 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.757811069 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.781507969 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.781538963 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.849277973 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.876274109 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.889959097 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.889981985 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:27:40.890233994 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:40.925630093 CEST	60837	443	192.168.2.4	142.250.176.206
Sep 1, 2024 01:27:41.010173082 CEST	443	60837	142.250.176.206	192.168.2.4
Sep 1, 2024 01:28:01.722780943 CEST	60745	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:28:01.722903967 CEST	65437	53	192.168.2.4	1.1.1.1
Sep 1, 2024 01:28:01.729336023 CEST	53	60745	1.1.1.1	192.168.2.4
Sep 1, 2024 01:28:01.729351044 CEST	53	65437	1.1.1.1	192.168.2.4
Sep 1, 2024 01:28:01.730210066 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.034174919 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.174968004 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.174990892 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.175002098 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.175013065 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.175024986 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.175518036 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.177303076 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.177381039 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.177589893 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.177637100 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.273072004 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.273088932 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.273098946 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.273107052 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.273386002 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.273423910 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.273859024 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.274085999 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.274221897 CEST	56375	443	192.168.2.4	172.64.41.3
Sep 1, 2024 01:28:02.367705107 CEST	443	56375	172.64.41.3	192.168.2.4
Sep 1, 2024 01:28:02.393450022 CEST	56375	443	192.168.2.4	172.64.41.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 1, 2024 01:26:04.741091013 CEST	192.168.2.4	1.1.1.1	c290	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 1, 2024 01:26:01.745697975 CEST	192.168.2.4	1.1.1.1	0x37cc	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:01.749327898 CEST	192.168.2.4	1.1.1.1	0x1fad	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 1, 2024 01:26:04.584192038 CEST	192.168.2.4	1.1.1.1	0x74cc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.584491014 CEST	192.168.2.4	1.1.1.1	0xe794	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:04.585063934 CEST	192.168.2.4	1.1.1.1	0xa419	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.585196018 CEST	192.168.2.4	1.1.1.1	0xf24f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:04.585441113 CEST	192.168.2.4	1.1.1.1	0x4617	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.585573912 CEST	192.168.2.4	1.1.1.1	0x5e0b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:04.586023092 CEST	192.168.2.4	1.1.1.1	0x2a5d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.586153984 CEST	192.168.2.4	1.1.1.1	0x44b7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:04.700618982 CEST	192.168.2.4	1.1.1.1	0xba3d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.700941086 CEST	192.168.2.4	1.1.1.1	0xfcee	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:19.670993090 CEST	192.168.2.4	1.1.1.1	0xfbf2	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:19.671139956 CEST	192.168.2.4	1.1.1.1	0xe5f8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:23.021754980 CEST	192.168.2.4	1.1.1.1	0x84a6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.022027969 CEST	192.168.2.4	1.1.1.1	0xe1ab	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:23.022413015 CEST	192.168.2.4	1.1.1.1	0xbb17	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.022602081 CEST	192.168.2.4	1.1.1.1	0x988e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:26:23.140616894 CEST	192.168.2.4	1.1.1.1	0xebd8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.140856028 CEST	192.168.2.4	1.1.1.1	0xf51	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:28:01.722780943 CEST	192.168.2.4	1.1.1.1	0xf4f3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:28:01.722903967 CEST	192.168.2.4	1.1.1.1	0x39a7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 1, 2024 01:26:01.752717018 CEST	1.1.1.1	192.168.2.4	0x37cc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:01.756469965 CEST	1.1.1.1	192.168.2.4	0x1fad	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:03.291157007 CEST	1.1.1.1	192.168.2.4	0xa4e2	No error (0)	shed.dual-low.s-part-0029.t-0009.t-msedge.net	s-part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:03.291157007 CEST	1.1.1.1	192.168.2.4	0xa4e2	No error (0)	s-part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.590908051 CEST	1.1.1.1	192.168.2.4	0x74cc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.590908051 CEST	1.1.1.1	192.168.2.4	0x74cc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.591224909 CEST	1.1.1.1	192.168.2.4	0xe794	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:04.591793060 CEST	1.1.1.1	192.168.2.4	0xa419	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.591793060 CEST	1.1.1.1	192.168.2.4	0xa419	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.591803074 CEST	1.1.1.1	192.168.2.4	0xf24f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:04.591856003 CEST	1.1.1.1	192.168.2.4	0x4617	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.591856003 CEST	1.1.1.1	192.168.2.4	0x4617	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.591922998 CEST	1.1.1.1	192.168.2.4	0x5e0b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:04.592567921 CEST	1.1.1.1	192.168.2.4	0x44b7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:04.593009949 CEST	1.1.1.1	192.168.2.4	0x2a5d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.593009949 CEST	1.1.1.1	192.168.2.4	0x2a5d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.707276106 CEST	1.1.1.1	192.168.2.4	0xba3d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.707276106 CEST	1.1.1.1	192.168.2.4	0xba3d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:04.707681894 CEST	1.1.1.1	192.168.2.4	0xfcee	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:19.677848101 CEST	1.1.1.1	192.168.2.4	0xfbf2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:19.677848101 CEST	1.1.1.1	192.168.2.4	0xfbf2	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.161	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:19.689182043 CEST	1.1.1.1	192.168.2.4	0xe5f8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:20.358077049 CEST	1.1.1.1	192.168.2.4	0x9ea7	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:20.358077049 CEST	1.1.1.1	192.168.2.4	0x9ea7	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:20.979279041 CEST	1.1.1.1	192.168.2.4	0x558e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:20.979279041 CEST	1.1.1.1	192.168.2.4	0x558e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:21.004585028 CEST	1.1.1.1	192.168.2.4	0xa999	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:21.990737915 CEST	1.1.1.1	192.168.2.4	0xda	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:21.990849018 CEST	1.1.1.1	192.168.2.4	0xaa77	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:21.990849018 CEST	1.1.1.1	192.168.2.4	0xaa77	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.028558016 CEST	1.1.1.1	192.168.2.4	0xe1ab	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:23.028795004 CEST	1.1.1.1	192.168.2.4	0xbb17	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.028795004 CEST	1.1.1.1	192.168.2.4	0xbb17	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.029210091 CEST	1.1.1.1	192.168.2.4	0x988e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:23.029561043 CEST	1.1.1.1	192.168.2.4	0x84a6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.029561043 CEST	1.1.1.1	192.168.2.4	0x84a6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.147320032 CEST	1.1.1.1	192.168.2.4	0xebd8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.147320032 CEST	1.1.1.1	192.168.2.4	0xebd8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:23.147589922 CEST	1.1.1.1	192.168.2.4	0xf51	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:26:24.013324976 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:24.013324976 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:25.014651060 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:25.014651060 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:26.026381016 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:26.026381016 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:28.026781082 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:28.026781082 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:26:32.041510105 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:26:32.041510105 CEST	1.1.1.1	192.168.2.4	0xa6bb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:28:01.729336023 CEST	1.1.1.1	192.168.2.4	0xf4f3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:28:01.729336023 CEST	1.1.1.1	192.168.2.4	0xf4f3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:28:01.729351044 CEST	1.1.1.1	192.168.2.4	0x39a7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:03 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:26:04 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:26:04 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T232604Z-16579567576j7nvvu5n0ytgs1c00000005mg00000000rrap Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 23:26:04 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:04 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:26:04 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:26:04 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T232604Z-16579567576h266g9d6dee9ff800000005s0000000008qsf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 23:26:04 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-31 23:26:04 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-31 23:26:04 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-31 23:26:04 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-31 23:26:04 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	172.64.41.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c8921f4a0cd9-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	172.64.41.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c8920f1b42fd-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49753	172.64.41.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c89209fb42b3-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	162.159.61.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c8920e0142a1-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9c 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	162.159.61.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c892c8560f59-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 14 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:06 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 23:26:06 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=235174 Date: Sat, 31 Aug 2024 23:26:06 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49763	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:07 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 23:26:07 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=235173 Date: Sat, 31 Aug 2024 23:26:07 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 23:26:07 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49764	142.250.81.238	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:07 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 23:26:07 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 23:26:07 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49765	142.250.81.238	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:07 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 23:26:07 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 23:26:07 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49766	142.250.72.100	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:07 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 23:26:08 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 23:20:50 GMT Expires: Sun, 08 Sep 2024 23:20:50 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 317 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 23:26:08 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-31 23:26:08 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-31 23:26:08 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-31 23:26:08 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-31 23:26:08 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49769	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1N2tpapSP4OpTbD&MD=ACb6XDY9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 23:26:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c743747e-4ea6-4f38-b3f2-3e03c5955046 MS-RequestId: 405eb7ad-299f-400c-a0da-a676b4938928 MS-CV: OC7Kaq6lYE66AFw8.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 23:26:15 GMT Connection: close Content-Length: 24490
2024-08-31 23:26:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-31 23:26:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49782	142.250.186.161	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:20 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:26:20 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljtshJJq4XgzdPlipWc9Q2qQueSSC0i22OaAOPbfphaLIaXL8i64mipNWME9W5aJ7mFnN9c X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Sat, 31 Aug 2024 19:15:10 GMT Expires: Sun, 31 Aug 2025 19:15:10 GMT Cache-Control: public, max-age=31536000 Age: 15070 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 23:26:20 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-08-31 23:26:20 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49785	13.107.246.60	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:21 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:26:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:26:21 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T232621Z-165795675766wv96mecap1swx400000005rg000000001cu3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 23:26:21 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49787	172.64.41.3	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c9055afc42fc-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f6 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49788	162.159.61.3	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c9055e5f726f-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49789	162.159.61.3	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:26:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c9065c0943b0-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49792	152.195.19.97	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:39 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725751580&P2=404&P3=2&P4=LexUDh4k1UVqbuxF1GnzVHV0MJK8nMmcz6sGKQuIesQQ3rCA1Zr4HlUzgKgZ1OFlqAL%2bwKA%2bevp37Cv0b2meYg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: /bSlhs2Ia+3LIbDXlJtrHi Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:26:39 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5073330 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sat, 31 Aug 2024 23:26:39 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-31 23:26:39 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49793	162.159.61.3	443	7576	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:26:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-31 23:26:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:26:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0c96d4f9c41c0-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:26:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d d7 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 03 00 02 c0 43 c0 43 00 01 00 01 00 00 00 03 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 03 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCkCO)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49797	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:26:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1N2tpapSP4OpTbD&MD=ACb6XDY9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 23:26:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 252993be-be97-4d5c-a930-ccad6349e2b2 MS-RequestId: 6c5c80e7-149c-4186-9c2e-108d495ac92a MS-CV: m4pHfOUgFkuCAYmE.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 23:26:53 GMT Connection: close Content-Length: 30005
2024-08-31 23:26:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-31 23:26:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49804	23.43.85.147	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:28:02 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:28:02 UTC	352	IN	HTTP/1.1 403 Forbidden Content-Length: 2342 Content-Type: text/html Date: Sat, 31 Aug 2024 23:28:02 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.d398d817.1725146882.42879083 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-08-31 23:28:02 UTC	1938	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 20 41 70 70 20 2d 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 66 65 61 74 75 72 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 36 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 39 35 Data Ascii: <!DOCTYPE html><html><head> <title>Web App - Unavailable</title> <style type="text/css"> html { height: 100%; width: 100%; } #feature { width: 960px; margin: 95

Target ID:	0
Start time:	19:25:55
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1a0000
File size:	917'504 bytes
MD5 hash:	D6F5BCA2F2CE2407AE4BF9115CFCA6D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	19:25:56
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:25:56
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,5833191931031966787,11974390165004238764,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:25:56
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	19:25:57
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	19:26:01
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7268 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:26:01
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7640 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x40000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:26:02
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff63b7b0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:26:02
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7824 --field-trial-handle=1804,i,18184782994043633640,12395179096115929868,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff63b7b0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:26:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	19:26:16
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2804 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	19:26:16
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4388 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:26:18
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8
Imagebase:	0x7ff63b7b0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:26:18
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6096 --field-trial-handle=2776,i,10210569004734922129,3048049955539561907,262144 /prefetch:8
Imagebase:	0x7ff63b7b0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:26:24
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:26:24
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2084,i,16719056843521875255,13518431660041794610,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:26:32
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:26:32
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2092,i,17085435103752643681,17795961976953740855,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:26:45
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:26:46
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2088,i,17697685816420570348,13963450996301655899,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1394
Total number of Limit Nodes:	46

Executed Functions

Function 001BF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 001BF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001FF474
IsIconic.USER32(00000000), ref: 001FF47D
ShowWindow.USER32(00000000,00000009), ref: 001FF48A
SetForegroundWindow.USER32(00000000), ref: 001FF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 001FF4AA
GetCurrentThreadId.KERNEL32 ref: 001FF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 001FF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 001FF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 001FF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 001FF4DE
SetForegroundWindow.USER32(00000000), ref: 001FF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF4F6
keybd_event.USER32(00000012,00000000), ref: 001FF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF50B
keybd_event.USER32(00000012,00000000), ref: 001FF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF519
keybd_event.USER32(00000012,00000000), ref: 001FF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF528
keybd_event.USER32(00000012,00000000), ref: 001FF52D
SetForegroundWindow.USER32(00000000), ref: 001FF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 001FF557

Strings

Shell_TrayWnd, xrefs: 001FF46F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: e0e87644c418b28d39c43cfc5f494887616c948bd7c360bdb702fd11cd6e62d9
Instruction ID: 903a1c8971733685c0402ede9cfe4a0ec1fa47e0f8c8230f3f92e7f78d8d9bdc
Opcode Fuzzy Hash: e0e87644c418b28d39c43cfc5f494887616c948bd7c360bdb702fd11cd6e62d9
Instruction Fuzzy Hash: 2F311071A40218BAEB216BB56C4AFBF7E6CEB44B50F210069FA05F61D1C7B19911AB60

Function 001A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 001A430D

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

GetCurrentProcess.KERNEL32(?,0023CB64,00000000,?,?), ref: 001A4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 001A4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 001A4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 001A4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 001A4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 001A447B
GetSystemInfo.KERNEL32(?,?,?), ref: 001A44A0

Strings

kernel32.dll, xrefs: 001A444F
GetNativeSystemInfo, xrefs: 001A4460
|O, xrefs: 001E36F8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 2ca3e9263f9b37219b2f0e4a10cce81a32b87ff381dde3caef25a03d21320b43
Instruction ID: 35573644a333e475a2fa4a68bec4851c81c08478e238265dd66cf1ed68120a6b
Opcode Fuzzy Hash: 2ca3e9263f9b37219b2f0e4a10cce81a32b87ff381dde3caef25a03d21320b43
Instruction Fuzzy Hash: F7A1C27691A7C0CFC715CB7E7C4D1A97FA46F6A300B1848D9E08D97AA2D36046E8CB61

Function 001A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,001A50AA,?,?,00000000,00000000), ref: 001A42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,001A50AA,?,?,00000000,00000000), ref: 001A42C9
LoadResource.KERNEL32(?,00000000,?,?,001A50AA,?,?,00000000,00000000,?,?,?,?,?,?,001A4F20), ref: 001E35BE
SizeofResource.KERNEL32(?,00000000,?,?,001A50AA,?,?,00000000,00000000,?,?,?,?,?,?,001A4F20), ref: 001E35D3
LockResource.KERNEL32(001A50AA,?,?,001A50AA,?,?,00000000,00000000,?,?,?,?,?,?,001A4F20,?), ref: 001E35E6

Strings

SCRIPT, xrefs: 001A42BF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: fe5ac1ef0caedac3f3f086fa1b33767d9eb80708c357a42ebb6c43879c77af4a
Instruction ID: ec97aca21926e40699942922ac832c9e00d7d43caa12b79947b3085879b2e118
Opcode Fuzzy Hash: fe5ac1ef0caedac3f3f086fa1b33767d9eb80708c357a42ebb6c43879c77af4a
Instruction Fuzzy Hash: 39117C75240700BFD7218B65EC4CF677BB9EBC6B51F20416AB842A6250DBB1D8048B20

Function 001E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 001A2B6B

Part of subcall function 001A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00271418,?,001A2E7F,?,?,?,00000000), ref: 001A3A78

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00262224), ref: 001E2C10
ShellExecuteW.SHELL32(00000000,?,?,00262224), ref: 001E2C17

Strings

runas, xrefs: 001E2C0B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 1cb19436823512730389561515bfd0be5d3e8700f14dcedc21eff3e9a2a64c5d
Instruction ID: 1c70f067b5aa0d27454a0060867bac931d1a4ea2eb33b804b02529b4a6658b9c
Opcode Fuzzy Hash: 1cb19436823512730389561515bfd0be5d3e8700f14dcedc21eff3e9a2a64c5d
Instruction Fuzzy Hash: 4511D6392083459BC714FF78E865ABEB7A4AFB3350F44542DF156520A2CF3185998712

Function 0020DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,001E5222), ref: 0020DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0020DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0020DBEE
FindClose.KERNEL32(00000000), ref: 0020DBFA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 78993ab6ed5795340b0cfbe2a3c53d554ebbbee2227e5dadaea882da1368c453
Instruction ID: 90d199480f11931bc5733840138f8ddc3fb2cdc15c8206a731aa771f39ecd48f
Opcode Fuzzy Hash: 78993ab6ed5795340b0cfbe2a3c53d554ebbbee2227e5dadaea882da1368c453
Instruction Fuzzy Hash: 74F0A031821A2057D3206FBCAC0D8AB3B6C9E01334BA04703F876D20E1EBB059648A95

Function 0022AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0022B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0022B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0022B1D4
_wcslen.LIBCMT ref: 0022B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0022B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0022B236
_wcslen.LIBCMT ref: 0022B332

Part of subcall function 002105A7: GetStdHandle.KERNEL32(000000F6), ref: 002105C6

_wcslen.LIBCMT ref: 0022B34B
_wcslen.LIBCMT ref: 0022B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0022B3B6
GetLastError.KERNEL32(00000000), ref: 0022B407
CloseHandle.KERNEL32(?), ref: 0022B439
CloseHandle.KERNEL32(00000000), ref: 0022B44A
CloseHandle.KERNEL32(00000000), ref: 0022B45C
CloseHandle.KERNEL32(00000000), ref: 0022B46E
CloseHandle.KERNEL32(?), ref: 0022B4E3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: a2b6b4634f81fa2fc84167eec191287482b35e1c4cc4783efd369d046a4db72f
Instruction ID: 34ab1a5d106493b7fa110d15edf5cc873fefe67c3ca89598ed84236f30ef154f
Opcode Fuzzy Hash: a2b6b4634f81fa2fc84167eec191287482b35e1c4cc4783efd369d046a4db72f
Instruction Fuzzy Hash: 33F1CD31518351EFC715EF24D891B6EBBE1AF85310F18855DF8899B2A2CB31ED50CB52

Function 001AD730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001AD807
timeGetTime.WINMM ref: 001ADA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001ADB28
TranslateMessage.USER32(?), ref: 001ADB7B
DispatchMessageW.USER32(?), ref: 001ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001ADB9F
Sleep.KERNELBASE(0000000A), ref: 001ADBB1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 136f35e30895763784047ce4d205c890f54b47967dada03476d0675ba3cfc3b2
Instruction ID: 96aa9e238c524f42ab1e60b35128148ca1e5cdf7064ec77a24192b520cd94245
Opcode Fuzzy Hash: 136f35e30895763784047ce4d205c890f54b47967dada03476d0675ba3cfc3b2
Instruction Fuzzy Hash: A0422134608B45EFD728CF24E888BBAB7E0BF46304F54451DE59A876A1C770E884CB92

Function 001A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001A2D07
RegisterClassExW.USER32(00000030), ref: 001A2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001A2D42
InitCommonControlsEx.COMCTL32(?), ref: 001A2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001A2D6F
LoadIconW.USER32(000000A9), ref: 001A2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001A2D94

Strings

AutoIt v3 GUI, xrefs: 001A2D23
0, xrefs: 001A2CE9
TaskbarCreated, xrefs: 001A2D37
+, xrefs: 001A2CF0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 0b75ee07abe551b98f91136518c2a568806cb2e4b849c45fe7384a9447eb4bd2
Instruction ID: 5ddc7996b691b91bd73c3f166321e978eceb12f644e849326431e0dd57ea3c77
Opcode Fuzzy Hash: 0b75ee07abe551b98f91136518c2a568806cb2e4b849c45fe7384a9447eb4bd2
Instruction Fuzzy Hash: 1D21E2B5951218EFDB00DFA8E88DBDDBBB8FB08700F10411AEA15B62A0D7B145908FA0

Function 001E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E039A: CreateFileW.KERNELBASE(00000000,00000000,?,001E0704,?,?,00000000,?,001E0704,00000000,0000000C), ref: 001E03B7

GetLastError.KERNEL32 ref: 001E076F
__dosmaperr.LIBCMT ref: 001E0776
GetFileType.KERNELBASE(00000000), ref: 001E0782
GetLastError.KERNEL32 ref: 001E078C
__dosmaperr.LIBCMT ref: 001E0795
CloseHandle.KERNEL32(00000000), ref: 001E07B5
CloseHandle.KERNEL32(?), ref: 001E08FF
GetLastError.KERNEL32 ref: 001E0931
__dosmaperr.LIBCMT ref: 001E0938

Strings

H, xrefs: 001E08BD

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: eaaa36550e883c90b86d1a12243af4f9bea24822383fa638259b706714998c35
Instruction ID: a1a58447023f8060250aaed8431c343ba44ed9457105e4fc5f6c0914295c707c
Opcode Fuzzy Hash: eaaa36550e883c90b86d1a12243af4f9bea24822383fa638259b706714998c35
Instruction Fuzzy Hash: 4AA14932A005848FDF1AAF68DC95BAD7BA1AB1A320F14015DF815AB3D1CB71DC57CB91

Function 001A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00271418,?,001A2E7F,?,?,?,00000000), ref: 001A3A78

Part of subcall function 001A3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 001A3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 001A356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 001E318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001E31CE
RegCloseKey.ADVAPI32(?), ref: 001E3210
_wcslen.LIBCMT ref: 001E3277
_wcslen.LIBCMT ref: 001E3286

Strings

Software\AutoIt v3\AutoIt, xrefs: 001A3560
Include, xrefs: 001E3184, 001E31C5
\Include\, xrefs: 001A3527
\, xrefs: 001E328C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: f5859028e7a6b1bf2a6d6d9ff7e312eb9d07ab1a123587894c96bdc22f96c8f3
Instruction ID: d058459676024c9696df3025b3b0809dca44213934d6022116a6759e5bff02af
Opcode Fuzzy Hash: f5859028e7a6b1bf2a6d6d9ff7e312eb9d07ab1a123587894c96bdc22f96c8f3
Instruction Fuzzy Hash: 7D71A171404301DEC304EF65EC899AFBBE8FFA6740F50486EF599971A0DB749A88CB51

Function 001A2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001A2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 001A2B9D
LoadIconW.USER32(00000063), ref: 001A2BB3
LoadIconW.USER32(000000A4), ref: 001A2BC5
LoadIconW.USER32(000000A2), ref: 001A2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001A2BEF
RegisterClassExW.USER32(?), ref: 001A2C40

Part of subcall function 001A2CD4: GetSysColorBrush.USER32(0000000F), ref: 001A2D07
Part of subcall function 001A2CD4: RegisterClassExW.USER32(00000030), ref: 001A2D31
Part of subcall function 001A2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001A2D42
Part of subcall function 001A2CD4: InitCommonControlsEx.COMCTL32(?), ref: 001A2D5F
Part of subcall function 001A2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001A2D6F
Part of subcall function 001A2CD4: LoadIconW.USER32(000000A9), ref: 001A2D85
Part of subcall function 001A2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001A2D94

Strings

#, xrefs: 001A2C16
0, xrefs: 001A2C0F
AutoIt v3, xrefs: 001A2C2F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f7a68227ef3c7c5a8c16e17b2fe05bc79b8a3a15490b702c3ad8dd814a841607
Instruction ID: 4203b8a323bf20e8a392c6396b2ca7c356d585c9b0e7a3ed9120463a3307af17
Opcode Fuzzy Hash: f7a68227ef3c7c5a8c16e17b2fe05bc79b8a3a15490b702c3ad8dd814a841607
Instruction Fuzzy Hash: 84213A75E00314ABDB109FA9FC4DBA9BFB4FF08B50F10009AE508B66A0D3B145A4CF90

Function 001AB710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001ABB4E

Strings

p#', xrefs: 001ABA72
p#', xrefs: 001ABB6B
p#', xrefs: 001F0263
p%', xrefs: 001ABB32
x#', xrefs: 001F0207
x#', xrefs: 001F0168
p#', xrefs: 001F024F
p%', xrefs: 001AB8DC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#'$p#'$p#'$p#'$p%'$p%'$x#'$x#'
API String ID: 1385522511-3771165580
Opcode ID: 6ed0c02ae3e30ba0bea79113d8dcdd8cd52e18dd020bda1eb76485205d0a2186
Instruction ID: 0b80a5cd9f36fce2e8b6255f5ac1567d48bf69d6262f9ed63d67b977944ec238
Opcode Fuzzy Hash: 6ed0c02ae3e30ba0bea79113d8dcdd8cd52e18dd020bda1eb76485205d0a2186
Instruction Fuzzy Hash: 5332FF78A08249DFCB25CF58C8D4ABEB7B5FF4A304F158059EA05AB252C774ED81CB91

Function 001A3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,001A316A,?,?), ref: 001A31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,001A316A,?,?), ref: 001A3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 001A3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,001A316A,?,?), ref: 001A3232
CreatePopupMenu.USER32 ref: 001A3246
PostQuitMessage.USER32(00000000), ref: 001A3267

Strings

TaskbarCreated, xrefs: 001A322D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 95858da1923f3b4ed5efe417a8671341b8086ed4b0bcbefba5b2fc1f2602b0ba
Instruction ID: 972b0cf61dad9f52c9f2a280ce226cbbb164eef2b894cbeb0f65785cc9fb68f7
Opcode Fuzzy Hash: 95858da1923f3b4ed5efe417a8671341b8086ed4b0bcbefba5b2fc1f2602b0ba
Instruction Fuzzy Hash: FA414C3D250304ABDB182B7CAD1EB7D365DEF47340F144116FA2A962E1CB718E5197A1

Function 001A2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001A2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 001A2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,001A1CAD,?), ref: 001A2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,001A1CAD,?), ref: 001A2CCF

Strings

edit, xrefs: 001A2CAC
AutoIt v3, xrefs: 001A2C89, 001A2C8E, 001A2C8F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 723e43a872b089f756c43ba46336e6eb68159bb8379e2ed9a8a185e095a5d3ff
Instruction ID: e07f7fc1eb136ab2221195e5acc834428e39f70941fb46084176cd1ccd281f17
Opcode Fuzzy Hash: 723e43a872b089f756c43ba46336e6eb68159bb8379e2ed9a8a185e095a5d3ff
Instruction Fuzzy Hash: 92F0DA755503907AEB31172BBC0EE777EBDDBC6F50F11409AF908A25A0C66118A0DAB0

Function 0020E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0020E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0020E9A5
Sleep.KERNEL32(00000000), ref: 0020E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0020E9B7
Sleep.KERNELBASE ref: 0020E9F3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 37f297163ebee8cec90230809ac3e2b06c215c6de1bced5a0c2b427133f7ccfb
Instruction ID: f6dee02ad45025786ac07dbc96fb49a13d02e21fad0503c4aee347a76f0b1ddc
Opcode Fuzzy Hash: 37f297163ebee8cec90230809ac3e2b06c215c6de1bced5a0c2b427133f7ccfb
Instruction Fuzzy Hash: 0F015B31C1162DDBCF009FE5E85D6DDBB78BB08301F110956E942B2192CB3095A087A2

Function 001A3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,001A3B0F,SwapMouseButtons,00000004,?), ref: 001A3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,001A3B0F,SwapMouseButtons,00000004,?), ref: 001A3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,001A3B0F,SwapMouseButtons,00000004,?), ref: 001A3B83

Strings

Control Panel\Mouse, xrefs: 001A3B3E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 62a9a14ef312cb720003ec6a0dc8acd16df0798931ef4041330c8ea140ba6c68
Instruction ID: e45965fdf73e5bcc0b124695c98e98e1887d9cb29539bc840eddb82597dfbb34
Opcode Fuzzy Hash: 62a9a14ef312cb720003ec6a0dc8acd16df0798931ef4041330c8ea140ba6c68
Instruction Fuzzy Hash: 97112AB9511208FFDB258FA5DC89AAEB7B9EF05744B104459B815E7210D3319E409760

Function 001A3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001E33A2

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 001A3A04

Strings

Line: , xrefs: 001E33EB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 21b8dcafb4d7f17f6ee2ab437183bb00791614ecfd50155d8f0426b605f54b62
Instruction ID: 3081397c31a23409b0f50948b9a58e222c51f50d6abff136603d4ac99a090814
Opcode Fuzzy Hash: 21b8dcafb4d7f17f6ee2ab437183bb00791614ecfd50155d8f0426b605f54b62
Instruction Fuzzy Hash: DB31E171408300AEC725EB24EC4AFEFB7E8AF52314F00452AF5A993091DB709A99C7C2

Function 001A2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 001E2C8C

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

Part of subcall function 001A2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 001A2DC4

Strings

`e&, xrefs: 001E2C85
X, xrefs: 001E2C5A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e&
API String ID: 779396738-1665243713
Opcode ID: 736f8d79ddb98dbe0fbfcafaf78f0f488c96d94bb0799a6483cda2ad940a7554
Instruction ID: 79cace3ec6a2a4e28e19df0850c3dafe022f6f2cc929ca5a78aa1d55e7b99a82
Opcode Fuzzy Hash: 736f8d79ddb98dbe0fbfcafaf78f0f488c96d94bb0799a6483cda2ad940a7554
Instruction Fuzzy Hash: 3621D575A10298AFCB05DF98C809BEE7BFCAF59304F104059E405F7241DBB89A898FA1

Function 001BFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 001C0668

Part of subcall function 001C32A4: RaiseException.KERNEL32(?,?,?,001C068A,?,00271444,?,?,?,?,?,?,001C068A,001A1129,00268738,001A1129), ref: 001C3304

__CxxThrowException@8.LIBVCRUNTIME ref: 001C0685

Strings

Unknown exception, xrefs: 001C0692

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 476d67bcf3605b14e69087e892691929c8be84d780f2de756a784c190cbc60d1
Instruction ID: 7fb7e138b25ea8fe2db64a8645f76ba7d81e5099fe59e9e52f5c046d3be721a4
Opcode Fuzzy Hash: 476d67bcf3605b14e69087e892691929c8be84d780f2de756a784c190cbc60d1
Instruction Fuzzy Hash: B2F0C23490020DB7CF05BAA4EC4AE9E7B6C5E34310B60453DF824D6591EF71DA66C6C0

Function 001A10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 001A1BF4
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 001A1BFC
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 001A1C07
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 001A1C12
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 001A1C1A
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 001A1C22

Part of subcall function 001A1B4A: RegisterWindowMessageW.USER32(00000004,?,001A12C4), ref: 001A1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 001A136A
OleInitialize.OLE32 ref: 001A1388
CloseHandle.KERNEL32(00000000,00000000), ref: 001E24AB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 62c47fb3473182d43348f8c628f1f9e6cf7bf1041b9c5f8530e1d34fbbcc528f
Instruction ID: d711203ace6a80a1c6cfd4a3f131c1d325d691fca329834e6e6722a52d316763
Opcode Fuzzy Hash: 62c47fb3473182d43348f8c628f1f9e6cf7bf1041b9c5f8530e1d34fbbcc528f
Instruction Fuzzy Hash: 4871CCB89212018FD388EF7EBC5E6653AE5FF99344794822AD00ED7261EB3044B4CF55

Function 0020C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 001A3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0020C259
KillTimer.USER32(?,00000001,?,?), ref: 0020C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0020C270

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 9b26dda0ab66f20d8c222c45af619fb7d9d1d80941b2eab4dda8f1d24711dd6b
Instruction ID: 8194e75ad151561e0c565b8b1d915c1f8fec6090691483c66c1f78eaa19c5183
Opcode Fuzzy Hash: 9b26dda0ab66f20d8c222c45af619fb7d9d1d80941b2eab4dda8f1d24711dd6b
Instruction Fuzzy Hash: 9331D9B0914344AFEB328F649859BD7BBEC9F16304F10049DD5DDA3282C7745A84CB51

Function 001D86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,001D85CC,?,00268CC8,0000000C), ref: 001D8704
GetLastError.KERNEL32(?,001D85CC,?,00268CC8,0000000C), ref: 001D870E
__dosmaperr.LIBCMT ref: 001D8739

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 2f36a014587dd34d6100ff2c7e8319a980cdc58b49ba2f8085ed684e11d71fbc
Instruction ID: 04f7f5e00d5647ff91714c0a12b348a0c3daa3d75e53f77f7f1731258e24ebeb
Opcode Fuzzy Hash: 2f36a014587dd34d6100ff2c7e8319a980cdc58b49ba2f8085ed684e11d71fbc
Instruction Fuzzy Hash: DA014E33A0566036D72467386849B7E6B4A9B91774F39015FF8189B3D2DFA0CC818250

Function 001ADB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 001ADB7B
DispatchMessageW.USER32(?), ref: 001ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001ADB9F
Sleep.KERNELBASE(0000000A), ref: 001ADBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 001F1CC9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 513de4b16549eecc8557b7d7946347fabd60622221ffe072338cf324488a084f
Instruction ID: b795b40c38f684cb789e9290e4af1d635b4daffc9c2ba4d4f8bac2f70d2cc7dd
Opcode Fuzzy Hash: 513de4b16549eecc8557b7d7946347fabd60622221ffe072338cf324488a084f
Instruction Fuzzy Hash: CFF05E316043449BE730CBA0AC49FEA73ACEF46310F104518E65A930C0DB309488CB26

Function 001B1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001B17F6

Strings

CALL, xrefs: 001B17C6

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 97062d5d35da3b0c73424a92804bd7d543d1d0df0e5638734547e72a78e81600
Instruction ID: 440fbbfd9a656943feab8887c2cd12c2f84c9ffd07bca9ff1266fee9ec07014d
Opcode Fuzzy Hash: 97062d5d35da3b0c73424a92804bd7d543d1d0df0e5638734547e72a78e81600
Instruction Fuzzy Hash: 3222AD70608201EFC714DF14C8A4BAABBF1BF99314F66891DF58A8B361D771E845CB92

Function 001A3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 001A3908

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 34403961d263c571cd1abe8d35455a3c1176f887f9865ea09d16a7122e944e0a
Instruction ID: 162a76c01ce763e79baa4f5c78bf026008cd416fc67bd748030b24527b8fcbf4
Opcode Fuzzy Hash: 34403961d263c571cd1abe8d35455a3c1176f887f9865ea09d16a7122e944e0a
Instruction Fuzzy Hash: 7231D5B4504700DFD320DF24E889797BBE8FF49708F00096EF5A983240E775AA54CB52

Function 001BF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 001BF661

Part of subcall function 001AD730: GetInputState.USER32 ref: 001AD807

Sleep.KERNEL32(00000000), ref: 001FF2DE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 2bf1f493a36f1b9de9af96da1e0de7c9c30dec818f7218f224f0f7a8c5c5ea41
Instruction ID: fe206e60d7e21a1bdc5845150dd733b26fe194862882f644c95c25910ea2295c
Opcode Fuzzy Hash: 2bf1f493a36f1b9de9af96da1e0de7c9c30dec818f7218f224f0f7a8c5c5ea41
Instruction Fuzzy Hash: DFF0A0352446059FD314EF79E859BAAB7E9FF5A760F004029E85ED73A2DB70A800CB90

Function 00232598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00232649

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: e586e8bac8809d38bd5049389eb11b6ad97e7e88e3cba800ef518943369cca31
Instruction ID: 3f72bfff72f6a1a8c10a468e03240bf3c107fe6c41646fe4da57965b1b57ca45
Opcode Fuzzy Hash: e586e8bac8809d38bd5049389eb11b6ad97e7e88e3cba800ef518943369cca31
Instruction Fuzzy Hash: F4212FB4200216EFE310DF28C8D0936B79DEF45368F60806CE8968B392CB71ED59CB90

Function 002313B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00231420

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 135d75ab3907e649c04c661dbe598ccaaa9f871811512e17788d655a0390d477
Instruction ID: eddbeb20c6ad06c1c043a3579c5e582093de249c5f0a00972095c0aed0d12bd4
Opcode Fuzzy Hash: 135d75ab3907e649c04c661dbe598ccaaa9f871811512e17788d655a0390d477
Instruction Fuzzy Hash: B131BF70614203AFD714EF29C491B69F7A2FF45328F048568E85A4B292DB71EC61CFD0

Function 001A4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E9C
Part of subcall function 001A4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001A4EAE
Part of subcall function 001A4E90: FreeLibrary.KERNEL32(00000000,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4EFD

Part of subcall function 001A4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E62
Part of subcall function 001A4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001A4E74
Part of subcall function 001A4E59: FreeLibrary.KERNEL32(00000000,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E87

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 708a8a74720e81128487f10d2a6fbd45c7429ebbbfbc927aff22a2d80e8e80c2
Instruction ID: 593570849f2e5cbc09b2ad10918853453e04f15140d1bd7065c1a61eaf9521c7
Opcode Fuzzy Hash: 708a8a74720e81128487f10d2a6fbd45c7429ebbbfbc927aff22a2d80e8e80c2
Instruction Fuzzy Hash: BA11043A610205ABCB14AB64D806FAD77A59FA1710F20842DF452A71C1EFB4AA049750

Function 001D8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001D8440

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 94e66632e157ce3c9e0ff920b25a119db89f4d3769846f676e00edbb29cf0d18
Instruction ID: b731050b0e8f0580d10ac0d4bd448aa01e4b09366b20558c0d6bdaf21670470e
Opcode Fuzzy Hash: 94e66632e157ce3c9e0ff920b25a119db89f4d3769846f676e00edbb29cf0d18
Instruction Fuzzy Hash: 9C11187590410AAFCB05DF58E941A9E7BF5EF48314F11405AF808AB312DB31EA15CBA5

Function 001D5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001D4C7D: RtlAllocateHeap.NTDLL(00000008,001A1129,00000000,?,001D2E29,00000001,00000364,?,?,?,001CF2DE,001D3863,00271444,?,001BFDF5,?), ref: 001D4CBE

_free.LIBCMT ref: 001D506C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 0841f1322374887edab72907c38f8fb7a4bf618268009866cecdcdefdc0bd66f
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 960126722047046BE3218E659881A5AFBEDFB99370F25051EF19483380EB30A805C6B4

Function 002329BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,002314B5,?), ref: 00232A01

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 510c706efbadffa016e470fcc4cd27aca020589386af39f10f9e13e0f7c548cc
Instruction ID: b321cdfd6f810057930b92bc318587498835077103db7b3e08a08f18f3a088df
Opcode Fuzzy Hash: 510c706efbadffa016e470fcc4cd27aca020589386af39f10f9e13e0f7c548cc
Instruction Fuzzy Hash: AD01B1B6720A42EFD325CE2CC454B227792EB89314F398468C1478B251DB32FC56C7A0

Function 001CE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 810b6e74dae7b9822729633cdaf36e56258f5781598787d21f27f4f9dc198099
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 74F0C832521A2497D7313A799C05F5A33DD9F72335F11072EF425933D2DB74E8028AA5

Function 0023149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 002314EB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: c8e4bede90eff28b519b4721cac5c5fea079303674164559813ea7b977736203
Instruction ID: b115c775d8b354f2f5e239d676d0e1f8fd4f66ac22fd21b91c76ee2db86d24d3
Opcode Fuzzy Hash: c8e4bede90eff28b519b4721cac5c5fea079303674164559813ea7b977736203
Instruction Fuzzy Hash: 2E012B753047419FD320CF69D440826BB95FF85324B54805EE94ACB712D772DDA2CBD0

Function 001D4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,001A1129,00000000,?,001D2E29,00000001,00000364,?,?,?,001CF2DE,001D3863,00271444,?,001BFDF5,?), ref: 001D4CBE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 924c36d50dc71402c8d330c70576d08fdbc42a4b4ddc7af25e4f919b61478919
Instruction ID: 09850db450a3f934e734deac76c3bcbb45d5c67a706a808dc5089a8816146422
Opcode Fuzzy Hash: 924c36d50dc71402c8d330c70576d08fdbc42a4b4ddc7af25e4f919b61478919
Instruction Fuzzy Hash: 71F0E23162622467DB215F66AC0AF5B3789BF617A1B19412BF819AA380CB70D80196E0

Function 001D3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 80e1de8623a64bdf1971b5bac521dac4db6477f1bc1fcb973503da5bb668582c
Instruction ID: 65e232ff6a6aa6ecac9cc938b21fd87edf42c8f29b09f29d42c1e7b7e6c14413
Opcode Fuzzy Hash: 80e1de8623a64bdf1971b5bac521dac4db6477f1bc1fcb973503da5bb668582c
Instruction Fuzzy Hash: 44E0E53110022457D62126669C05F9A374AAF527B0F1A022ABC24966D0CB50ED01B2E3

Function 001A4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4F6D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d99dc98c641b30178141905d9dc5c53c3d905949d60f645e0c2a90c857672207
Instruction ID: 4cbb2b07764946db11e5b3c08f293681e07850fdc03d799543fd108765ca708f
Opcode Fuzzy Hash: d99dc98c641b30178141905d9dc5c53c3d905949d60f645e0c2a90c857672207
Instruction Fuzzy Hash: C5F0A075005351CFCB388F38D490812B7F0AF51319320997EE1DA82611C7B19844DF40

Function 00232A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00232A66

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: ab2f0d379b07f30cd38d8f6fc8044afb745ca2e4d01e8c28c0e5c3836e9b13c2
Instruction ID: 683e59276caabb2fd07b4db69c45bca0eba2d480c84bb727ce00bfdfa7fb13f6
Opcode Fuzzy Hash: ab2f0d379b07f30cd38d8f6fc8044afb745ca2e4d01e8c28c0e5c3836e9b13c2
Instruction Fuzzy Hash: CDE04FB637021AEBC714EA30EC908FAB39CEF50795B104536ED1AD2141DF3099B98AA0

Function 001A2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 001A2DC4

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 38078d8f2aeee84476adbc150acd082077c3770009101f71df0eed7562f2c28d
Instruction ID: 4833d4cf9faffa81ad9aca75093603b2e85aaa5b752b2f3836db7d14f7c2f5a4
Opcode Fuzzy Hash: 38078d8f2aeee84476adbc150acd082077c3770009101f71df0eed7562f2c28d
Instruction Fuzzy Hash: 34E0CD766001245BC71192589C05FDE77DDDFC8790F040071FD09E7248DA70AD848690

Function 001A2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001A3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 001A3908

Part of subcall function 001AD730: GetInputState.USER32 ref: 001AD807

SetCurrentDirectoryW.KERNEL32(?), ref: 001A2B6B

Part of subcall function 001A30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 001A314E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 45cbd71cd768268b55ccdd11d34fecae09105f9e4eb9ebede4dd58509f2ffceb
Instruction ID: d2b72b6a6684cf0d2ab727a9c9db2934460354204041deb765c1c4879632a569
Opcode Fuzzy Hash: 45cbd71cd768268b55ccdd11d34fecae09105f9e4eb9ebede4dd58509f2ffceb
Instruction Fuzzy Hash: 0AE0262A30020407C608BB78B82667DB3498FF3351F40053EF05743162CF2445954311

Function 00203D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00203D18

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 6209db1dbe20990c0a470cf650136a890b4028d12f8168d364972618efaa2e17
Instruction ID: 05d419dc7036c971d5e3fa2e950c776ecb01ae39cf5ce1b5fb8c9a1259a18aee
Opcode Fuzzy Hash: 6209db1dbe20990c0a470cf650136a890b4028d12f8168d364972618efaa2e17
Instruction Fuzzy Hash: 6DD08CF06A03087EFB0087719C0BEBB339CC356E81F104BA47E02E64C1D9A0DE080630

Function 001E039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,001E0704,?,?,00000000,?,001E0704,00000000,0000000C), ref: 001E03B7

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6079ccc06b75d68aba04b9b4a144eaf42c3498d591c4d31f8fc5776ad9e70905
Instruction ID: f136de914de95d677c83f2dea2064a93602f73d92cc7b73d873672b0c28a06c7
Opcode Fuzzy Hash: 6079ccc06b75d68aba04b9b4a144eaf42c3498d591c4d31f8fc5776ad9e70905
Instruction Fuzzy Hash: 13D06C3204010DBBDF028F84ED0AEDA3BAAFB48714F114000BE5866020C732E821AB90

Function 001A1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 001A1CBC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a593b6aa037e1f8e45053129bb3d9c36fb922878e1f133f289a604e1976a58b0
Instruction ID: d5c60ba40dd504318b5775d7c9232c310e85b045e6eaf8861b1f6b9fbd9b9626
Opcode Fuzzy Hash: a593b6aa037e1f8e45053129bb3d9c36fb922878e1f133f289a604e1976a58b0
Instruction Fuzzy Hash: F0C09236280304EFF2188B94BC4EF107764E748B00F948001F64DB95E3C3A228A0EB60

Non-executed Functions

Function 00239576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0023961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0023965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0023969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002396C9
SendMessageW.USER32 ref: 002396F2
GetKeyState.USER32(00000011), ref: 0023978B
GetKeyState.USER32(00000009), ref: 00239798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002397AE
GetKeyState.USER32(00000010), ref: 002397B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002397E9
SendMessageW.USER32 ref: 00239810
SendMessageW.USER32(?,00001030,?,00237E95), ref: 00239918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0023992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00239941
SetCapture.USER32(?), ref: 0023994A
ClientToScreen.USER32(?,?), ref: 002399AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 002399BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002399D6
ReleaseCapture.USER32 ref: 002399E1
GetCursorPos.USER32(?), ref: 00239A19
ScreenToClient.USER32(?,?), ref: 00239A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00239A80
SendMessageW.USER32 ref: 00239AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00239AEB
SendMessageW.USER32 ref: 00239B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00239B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00239B4A
GetCursorPos.USER32(?), ref: 00239B68
ScreenToClient.USER32(?,?), ref: 00239B75
GetParent.USER32(?), ref: 00239B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00239BFA
SendMessageW.USER32 ref: 00239C2B
ClientToScreen.USER32(?,?), ref: 00239C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00239CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00239CDE
SendMessageW.USER32 ref: 00239D01
ClientToScreen.USER32(?,?), ref: 00239D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00239D82

Part of subcall function 001B9944: GetWindowLongW.USER32(?,000000EB), ref: 001B9952

GetWindowLongW.USER32(?,000000F0), ref: 00239E05

Strings

@GUI_DRAGID, xrefs: 0023997D
F, xrefs: 00239D07
p#', xrefs: 00239990

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#'
API String ID: 3429851547-1308831974
Opcode ID: 7cf4da45cae248a78c93a73659c507c81095cdcbd07874e07f43762641e15e93
Instruction ID: 1f9075e557558f0a0bb11dc10e38274c8a4ecba04f0397a91dbcf5494703ad4b
Opcode Fuzzy Hash: 7cf4da45cae248a78c93a73659c507c81095cdcbd07874e07f43762641e15e93
Instruction Fuzzy Hash: 8042D1B4615201AFD724CF28DC49EAABBF9FF4A310F100619F699972A1D7B1D8A1CF41

Function 00234873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 002348F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00234908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00234927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0023494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0023495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0023497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 002349AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 002349D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00234A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00234A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00234A7E
IsMenu.USER32(?), ref: 00234A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00234AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00234B20
GetWindowLongW.USER32(?,000000F0), ref: 00234B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00234BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00234C82
wsprintfW.USER32 ref: 00234CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00234CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00234CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00234D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00234D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00234D5A

Strings

%d/%02d/%02d, xrefs: 00234CA8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: eff2f82cfa4f089307992db3627b571b781f9fd7084fd6c9e1143fa10828574c
Instruction ID: b24c49adbd4dd68df6a7c7596dc692fb6c0806941010c18dce4b5d1fa9afa2ad
Opcode Fuzzy Hash: eff2f82cfa4f089307992db3627b571b781f9fd7084fd6c9e1143fa10828574c
Instruction Fuzzy Hash: 1F1223B1620205ABEB24AF24DC49FAE7BF8EF85300F1441A9F515EB2E1DB74A951CF50

Function 00201201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 002016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0020170D
Part of subcall function 002016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0020173A
Part of subcall function 002016C3: GetLastError.KERNEL32 ref: 0020174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00201286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 002012A8
CloseHandle.KERNEL32(?), ref: 002012B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002012D1
GetProcessWindowStation.USER32 ref: 002012EA
SetProcessWindowStation.USER32(00000000), ref: 002012F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00201310

Part of subcall function 002010BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002011FC), ref: 002010D4
Part of subcall function 002010BF: CloseHandle.KERNEL32(?,?,002011FC), ref: 002010E9

Strings

default, xrefs: 0020130B
Z&, xrefs: 00201392
, xrefs: 0020125A
winsta0, xrefs: 002012CC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z&
API String ID: 22674027-566727265
Opcode ID: dc3b73a309ae68889e9e3c4afcdbea21ed5a90978963e66d5586d6fc1f7dc041
Instruction ID: 5afbb2af3650f63fec46d24eb8fbf788d289115834f33cab1463b87168b199bb
Opcode Fuzzy Hash: dc3b73a309ae68889e9e3c4afcdbea21ed5a90978963e66d5586d6fc1f7dc041
Instruction Fuzzy Hash: 8F819A7191034AAFDF219FA4DC4AFEE7BB9EF08704F144129F910B61A2D7718A64CB20

Function 00200B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00201114
Part of subcall function 002010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201120
Part of subcall function 002010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 0020112F
Part of subcall function 002010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201136
Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0020114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00200BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00200C00
GetLengthSid.ADVAPI32(?), ref: 00200C17
GetAce.ADVAPI32(?,00000000,?), ref: 00200C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00200C6D
GetLengthSid.ADVAPI32(?), ref: 00200C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00200C8C
HeapAlloc.KERNEL32(00000000), ref: 00200C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00200CB4
CopySid.ADVAPI32(00000000), ref: 00200CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00200CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00200D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00200D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200D45
HeapFree.KERNEL32(00000000), ref: 00200D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200D55
HeapFree.KERNEL32(00000000), ref: 00200D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200D65
HeapFree.KERNEL32(00000000), ref: 00200D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00200D78
HeapFree.KERNEL32(00000000), ref: 00200D7F

Part of subcall function 00201193: GetProcessHeap.KERNEL32(00000008,00200BB1,?,00000000,?,00200BB1,?), ref: 002011A1
Part of subcall function 00201193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00200BB1,?), ref: 002011A8
Part of subcall function 00201193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00200BB1,?), ref: 002011B7

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c96197ae0973bcfdd798a6a2b260e6eda35917ed85d1fc99cdebdf70fda45015
Instruction ID: 31007e7d8c00b0935f44ad4fa32221585e985e2de2b05f3d32609d47e5ad9a22
Opcode Fuzzy Hash: c96197ae0973bcfdd798a6a2b260e6eda35917ed85d1fc99cdebdf70fda45015
Instruction Fuzzy Hash: 63716A7691020AABEF10DFA4EC88FAEBBB8FF04310F144525E914B7192D771AA15CB70

Function 0021EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0023CC08), ref: 0021EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0021EB37
GetClipboardData.USER32(0000000D), ref: 0021EB43
CloseClipboard.USER32 ref: 0021EB4F
GlobalLock.KERNEL32(00000000), ref: 0021EB87
CloseClipboard.USER32 ref: 0021EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0021EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0021EBC9
GetClipboardData.USER32(00000001), ref: 0021EBD1
GlobalLock.KERNEL32(00000000), ref: 0021EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0021EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0021EC38
GetClipboardData.USER32(0000000F), ref: 0021EC44
GlobalLock.KERNEL32(00000000), ref: 0021EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0021EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0021EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0021ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0021ECF3
CountClipboardFormats.USER32 ref: 0021ED14
CloseClipboard.USER32 ref: 0021ED59

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 644b447b6dcd8fced4f0098bc2424924ec26d6fa59a76d3d2b03c0573d4cc652
Instruction ID: eb48798bc86edb102aec9992e6aa7b0122c56b41cdd29a842c6730e252a18080
Opcode Fuzzy Hash: 644b447b6dcd8fced4f0098bc2424924ec26d6fa59a76d3d2b03c0573d4cc652
Instruction Fuzzy Hash: FB61E2752042029FD700EF20EC89FAA77E8BFA5714F19451DF856972A1CB70DD85CBA2

Function 0021698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 002169BE
FindClose.KERNEL32(00000000), ref: 00216A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00216A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00216A75

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00216AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00216ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00216B32
%4d, xrefs: 00216BB1
%02d, xrefs: 00216C00, 00216C0A, 00216C5A, 00216CAA, 00216CFA, 00216D4A
%03d, xrefs: 00216DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00216B6A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 51fea610ecfe70612a3926ee95d3b55bdf0a8d99cefbd08c6830dede9dbefc68
Instruction ID: 48ce0f1084791d474fe12e25f0479c731c9cf9ce840b5fceaf06a3e7df952b8a
Opcode Fuzzy Hash: 51fea610ecfe70612a3926ee95d3b55bdf0a8d99cefbd08c6830dede9dbefc68
Instruction Fuzzy Hash: 45D17DB6508300AEC310EFA4CD95EAFB7ECAFA9704F04491DF585D6191EB74DA44CBA2

Function 00219642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00219663
GetFileAttributesW.KERNEL32(?), ref: 002196A1
SetFileAttributesW.KERNEL32(?,?), ref: 002196BB
FindNextFileW.KERNEL32(00000000,?), ref: 002196D3
FindClose.KERNEL32(00000000), ref: 002196DE
FindFirstFileW.KERNEL32(*.*,?), ref: 002196FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0021974A
SetCurrentDirectoryW.KERNEL32(00266B7C), ref: 00219768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00219772
FindClose.KERNEL32(00000000), ref: 0021977F
FindClose.KERNEL32(00000000), ref: 0021978F

Strings

*.*, xrefs: 002196F5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 571583c7eb56509ed8c7d75dc5236f18c3483552ab4cd94b8de97f5eda9e2a22
Instruction ID: 7eb4fa3bb4eaeac318fec79bfa87fdb18502f8292ea8ba44f5b6e4a4549a6e2f
Opcode Fuzzy Hash: 571583c7eb56509ed8c7d75dc5236f18c3483552ab4cd94b8de97f5eda9e2a22
Instruction Fuzzy Hash: 2331A27255021AAADB14AFB4EC5DADE77EC9F19320F204166F815E20D0DB30D9D58B64

Function 0021979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 002197BE
FindNextFileW.KERNEL32(00000000,?), ref: 00219819
FindClose.KERNEL32(00000000), ref: 00219824
FindFirstFileW.KERNEL32(*.*,?), ref: 00219840
SetCurrentDirectoryW.KERNEL32(?), ref: 00219890
SetCurrentDirectoryW.KERNEL32(00266B7C), ref: 002198AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 002198B8
FindClose.KERNEL32(00000000), ref: 002198C5
FindClose.KERNEL32(00000000), ref: 002198D5

Part of subcall function 0020DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0020DB00

Strings

*.*, xrefs: 0021983B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 878741df419c1727c74e7e0cedbf891a71052a8258543ff7ee552bce01ce76f5
Instruction ID: b43f44e26597519ab78bb207a328c1cb129778ec22742145f0b0c43d7027809c
Opcode Fuzzy Hash: 878741df419c1727c74e7e0cedbf891a71052a8258543ff7ee552bce01ce76f5
Instruction Fuzzy Hash: CC31D23251121AAEDB20EFB4EC58ADE77ECAF16324F214165E814B20D1DB31DEE5CB20

Function 0022BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0022BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0022BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0022C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0022C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0022C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0022C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0022C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0022C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0022C382
RegCloseKey.ADVAPI32(00000000), ref: 0022C38F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: e44e3f4ff3347644d237c88a141333ece010d4a61e68aaa12bb7fd49c815f76b
Instruction ID: a37468231a9047d7b027cc9c67d7aef3fdd8f155b2df7475888ac183e88925ff
Opcode Fuzzy Hash: e44e3f4ff3347644d237c88a141333ece010d4a61e68aaa12bb7fd49c815f76b
Instruction Fuzzy Hash: 01029F70614211AFC714CF68D895E2ABBE4EF49318F18C89CF84ACB2A2DB31ED55CB51

Function 00218195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00218257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00218267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00218273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00218310
SetCurrentDirectoryW.KERNEL32(?), ref: 00218324
SetCurrentDirectoryW.KERNEL32(?), ref: 00218356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0021838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00218395

Strings

*.*, xrefs: 0021839B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 40c1ccc08d410c72b6d4b0a8f3122f45a2ee88bff21027ce6748e0f6d4053942
Instruction ID: 36865435f1d1a340592952fdb0c6187d55fffa0b852eca5885527f34a9a3113a
Opcode Fuzzy Hash: 40c1ccc08d410c72b6d4b0a8f3122f45a2ee88bff21027ce6748e0f6d4053942
Instruction Fuzzy Hash: CC61BB725183459FCB10EF20D8849AFB3E8FFA9310F04486DF89983251DB31E995CB92

Function 0020D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

Part of subcall function 0020E199: GetFileAttributesW.KERNEL32(?,0020CF95), ref: 0020E19A

FindFirstFileW.KERNEL32(?,?), ref: 0020D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0020D1DD
MoveFileW.KERNEL32(?,?), ref: 0020D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0020D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0020D237

Part of subcall function 0020D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0020D21C,?,?), ref: 0020D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0020D253
FindClose.KERNEL32(00000000), ref: 0020D264

Strings

\*.*, xrefs: 0020D0CD, 0020D0D6, 0020D0EB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 84dccdac2e9f3d8e60d48a05c3e1c5deef5147ab9ce02d5e9fef3912e44c3752
Instruction ID: 1e6561e0b9a33306864f723b66b38beb4a973c1b3335d195c601d235710218dc
Opcode Fuzzy Hash: 84dccdac2e9f3d8e60d48a05c3e1c5deef5147ab9ce02d5e9fef3912e44c3752
Instruction Fuzzy Hash: 55617D3580221DAFCF05EFE0DA929EEB775AF25300F208165E80677192EB306F59CB60

Function 0021ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0021ED91
EmptyClipboard.USER32 ref: 0021ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0021EDAC
CloseClipboard.USER32 ref: 0021EEA3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c2c74f7d6eaeae1d04cca2923b4d3c591225285c4e88ffdb0c93bbb210e25546
Instruction ID: e2bdeccfe5b5f14ae0a5f99bd71454da9f20b98801ef0ddde6e27406a025430f
Opcode Fuzzy Hash: c2c74f7d6eaeae1d04cca2923b4d3c591225285c4e88ffdb0c93bbb210e25546
Instruction Fuzzy Hash: 0641EF35214612AFE710CF25E88DF5ABBE4FF54328F15C099E8198B662C771EC81CB90

Function 0020E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 002016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0020170D
Part of subcall function 002016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0020173A
Part of subcall function 002016C3: GetLastError.KERNEL32 ref: 0020174A

ExitWindowsEx.USER32(?,00000000), ref: 0020E932

Strings

, xrefs: 0020E920
SeShutdownPrivilege, xrefs: 0020E902
, xrefs: 0020E95C
@, xrefs: 0020E925

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: d501260110d556afc3daa0639d779df3949beed2befd27f19bea7f93a4827391
Instruction ID: 229053e9b9d6a9bed471dfe98b003fdd6f8b7f0890b856fdeb46011f7e902b82
Opcode Fuzzy Hash: d501260110d556afc3daa0639d779df3949beed2befd27f19bea7f93a4827391
Instruction Fuzzy Hash: E001D67363031AABEF5426B4AC8ABBB726CA714750F264D21FC02F21D3D5A15CA08690

Function 00221204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00221276
WSAGetLastError.WSOCK32 ref: 00221283
bind.WSOCK32(00000000,?,00000010), ref: 002212BA
WSAGetLastError.WSOCK32 ref: 002212C5
closesocket.WSOCK32(00000000), ref: 002212F4
listen.WSOCK32(00000000,00000005), ref: 00221303
WSAGetLastError.WSOCK32 ref: 0022130D
closesocket.WSOCK32(00000000), ref: 0022133C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 1af0669879d2fb4e8f5906e833a2a5a4c418eebd9ce6c3dbc1ec8e605a1908a3
Instruction ID: 2d1ffa3d36cf9a585045275e5d61e3c2b34423045477bddf9ec4eef868a47dfc
Opcode Fuzzy Hash: 1af0669879d2fb4e8f5906e833a2a5a4c418eebd9ce6c3dbc1ec8e605a1908a3
Instruction Fuzzy Hash: 1741B435A10121EFD710DF64E488F29BBE6AF56314F288188E8569F2D6C771ED91CBE0

Function 0020D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

Part of subcall function 0020E199: GetFileAttributesW.KERNEL32(?,0020CF95), ref: 0020E19A

FindFirstFileW.KERNEL32(?,?), ref: 0020D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0020D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0020D481
FindClose.KERNEL32(00000000), ref: 0020D498
FindClose.KERNEL32(00000000), ref: 0020D4A1

Strings

\*.*, xrefs: 0020D3F2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 98cb95761f2b0b74d86282a5489622a997db3d9c0335b29b486d3a094614f8af
Instruction ID: 5e752a81ae7ee52c83f027d53c1c1eb3d90240b2a939d059a41eaa379dfa3924
Opcode Fuzzy Hash: 98cb95761f2b0b74d86282a5489622a997db3d9c0335b29b486d3a094614f8af
Instruction Fuzzy Hash: 9131A0350193459FC301EF64D8959AFB7A8BEA2314F844A1DF4D193192EB30AA19CB63

Function 001DE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001DE645

Strings

1#SNAN, xrefs: 001DF844
1#IND, xrefs: 001DF83D
1#INF, xrefs: 001DF852
1#QNAN, xrefs: 001DF84B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: eb016193f85f1b72ff8aea2487a4cb721fb916f833cc8509648c1c3a4ddde0d3
Instruction ID: 83fe8b77cad68d8bb3de4ddd40fb0687622b005d21e49b22b5275b49c7cafe12
Opcode Fuzzy Hash: eb016193f85f1b72ff8aea2487a4cb721fb916f833cc8509648c1c3a4ddde0d3
Instruction Fuzzy Hash: A9C22971E046288FDB29DF289D407EAB7B5EB59305F1541EBD84EE7240E774AE828F40

Function 0021648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 002164DC
CoInitialize.OLE32(00000000), ref: 00216639
CoCreateInstance.OLE32(0023FCF8,00000000,00000001,0023FB68,?), ref: 00216650
CoUninitialize.OLE32 ref: 002168D4

Strings

.lnk, xrefs: 002164BA, 00216524, 002165E0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: b8b1d96039e2cb23c975c85e591617a8f0a398077bcfb1d3e3b4aa211dcbda59
Instruction ID: 5674208093ce6bda179978d144670ceef188c664290687257484c55db606bab3
Opcode Fuzzy Hash: b8b1d96039e2cb23c975c85e591617a8f0a398077bcfb1d3e3b4aa211dcbda59
Instruction Fuzzy Hash: EFD16A71518301AFC304EF24C881EABB7E9FFA9304F50492DF5958B291DB31E949CB92

Function 002222DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 002222E8

Part of subcall function 0021E4EC: GetWindowRect.USER32(?,?), ref: 0021E504

GetDesktopWindow.USER32 ref: 00222312
GetWindowRect.USER32(00000000), ref: 00222319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00222355
GetCursorPos.USER32(?), ref: 00222381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 002223DF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: b63625340914dba303f0b960c2a45601d7e5f0b8ac7b8e3edfda79fb228e3da5
Instruction ID: f21cc0f911d9d9cbbb7ecb8cb622873a0eb98eb2e678bbec65ba0a0732a68179
Opcode Fuzzy Hash: b63625340914dba303f0b960c2a45601d7e5f0b8ac7b8e3edfda79fb228e3da5
Instruction Fuzzy Hash: 27310272504315AFDB20DF54E809B9BB7A9FF84310F100A19F984A7191DB75E918CB92

Function 00219B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00219B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00219C8B

Part of subcall function 00213874: GetInputState.USER32 ref: 002138CB
Part of subcall function 00213874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00213966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00219BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00219C75

Strings

*.*, xrefs: 00219B5D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 9eff5af583d886acdfc7102c7017c1c8ee51d72e94f7736aff73c440118d0885
Instruction ID: c2fc6614c887521ddc24e4a910d96e4ed61fb7fa2ef6a4462cc9da60b719d171
Opcode Fuzzy Hash: 9eff5af583d886acdfc7102c7017c1c8ee51d72e94f7736aff73c440118d0885
Instruction Fuzzy Hash: 9141717191420A9FCF14DF64D859AEEBBF8EF29310F244056E845A2191EB309ED4CFA0

Function 001B997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 001B9A4E
GetSysColor.USER32(0000000F), ref: 001B9B23
SetBkColor.GDI32(?,00000000), ref: 001B9B36

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: f0b8125449c541c592fe579eee7d0cc52b3b186d229cab89dd2b34faab2eec73
Instruction ID: 5c66a17c230980777dba49047c836316f7c1c07ef6eef288394d0a172e998712
Opcode Fuzzy Hash: f0b8125449c541c592fe579eee7d0cc52b3b186d229cab89dd2b34faab2eec73
Instruction Fuzzy Hash: 30A1F4B0118448AEE728AA3C9C9DEFB369DDF42350F264209F702D76D1CB259D53C672

Function 00221806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0022304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0022307A
Part of subcall function 0022304E: _wcslen.LIBCMT ref: 0022309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0022185D
WSAGetLastError.WSOCK32 ref: 00221884
bind.WSOCK32(00000000,?,00000010), ref: 002218DB
WSAGetLastError.WSOCK32 ref: 002218E6
closesocket.WSOCK32(00000000), ref: 00221915

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 1274ed1e2b7e2bb4e92d9c03fa6943d323b5f3a6ef42e239c00267e353acbd6e
Instruction ID: 1ea798785d1009919932709666415928f1f17f8fd182fa86fb8703dc0d377d5c
Opcode Fuzzy Hash: 1274ed1e2b7e2bb4e92d9c03fa6943d323b5f3a6ef42e239c00267e353acbd6e
Instruction Fuzzy Hash: D151E475A00210AFEB10AF64D88AF6A77E5AB55718F18805CF9096F3C3C771ED418BA1

Function 00231C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00231CC0
IsWindowEnabled.USER32 ref: 00231CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00231CDB
IsIconic.USER32 ref: 00231CE9
IsZoomed.USER32 ref: 00231CF7

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 438ed37bff20953360f256c11c73f6128dd9cc42028f5b252b924fcd5825e433
Instruction ID: 4ade058c146b73e24960ea60121be29caea7ada774b85d2b01dc777d512a2d9e
Opcode Fuzzy Hash: 438ed37bff20953360f256c11c73f6128dd9cc42028f5b252b924fcd5825e433
Instruction Fuzzy Hash: 572127B17502019FD3208F2AD884B2A7BE4FF85310F189469E846DB351CB71DC62CBD1

Function 001A8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 001A843C
ERCP, xrefs: 001A813C
VUUU, xrefs: 001E5DF0
VUUU, xrefs: 001A83E8
VUUU, xrefs: 001A83FA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: d9a32929095a4b862dc71f3faa702a94f1434bfc511516c703bb04ba6a3e4cc2
Instruction ID: afa5b8f2c5bd56b1a7a3fdddd8a3731c346334126634ef6afd94b5e41e9e69df
Opcode Fuzzy Hash: d9a32929095a4b862dc71f3faa702a94f1434bfc511516c703bb04ba6a3e4cc2
Instruction Fuzzy Hash: F7A2A274E00A5ACBDF28CF59C8507BEB7B2BF55314F2581AAE819A7285DB309D81CF50

Function 00208298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 002082AA

Strings

tb&, xrefs: 002084F4
(, xrefs: 002082F0
|, xrefs: 002082DA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tb&$|
API String ID: 1659193697-4108677313
Opcode ID: cfbd98dbefa08176cd0cd851b7c6d57981bf53be5cfc127f13952c777d7aac7a
Instruction ID: 6de78303108b6fc5baba1d46524c6992c1c633b24a95418806bd36fabc98f7f4
Opcode Fuzzy Hash: cfbd98dbefa08176cd0cd851b7c6d57981bf53be5cfc127f13952c777d7aac7a
Instruction Fuzzy Hash: F6323674A107069FCB28CF59C481A6AB7F0FF48710B15C56EE59ADB3A2EB70E951CB40

Function 0022A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0022A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0022A6BA

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0022A79C
CloseHandle.KERNEL32(00000000), ref: 0022A7AB

Part of subcall function 001BCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,001E3303,?), ref: 001BCE8A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: c4d03cec355c8157119c8f2998e990b431c981b29ac7d75c3c69b8befa8998de
Instruction ID: 570b20ca3b39add3c4092f3d33319d972799524ee258515ad3239e056cdf8d92
Opcode Fuzzy Hash: c4d03cec355c8157119c8f2998e990b431c981b29ac7d75c3c69b8befa8998de
Instruction Fuzzy Hash: C2516DB5508310AFD710EF24D886A6BBBE8FF99754F40892DF58997291EB30D904CB92

Function 0020AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0020AAAC
SetKeyboardState.USER32(00000080), ref: 0020AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0020AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0020AB88

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9b8dced380253d8ecbe8109f9e3d56bd427cd73fa59dcff0f772f8e9e75aeffa
Instruction ID: 9f138887619e788a9cb2371d272a24ed898676d32cf2f1c1bd13b09c9752ce61
Opcode Fuzzy Hash: 9b8dced380253d8ecbe8109f9e3d56bd427cd73fa59dcff0f772f8e9e75aeffa
Instruction Fuzzy Hash: FB313B31A60309AEFF35CF64CC05BFA7BAAAB64314F94421AF481561D3D374C9A1C762

Function 001DBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001DBB7F

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

GetTimeZoneInformation.KERNEL32 ref: 001DBB91
WideCharToMultiByte.KERNEL32(00000000,?,0027121C,000000FF,?,0000003F,?,?), ref: 001DBC09
WideCharToMultiByte.KERNEL32(00000000,?,00271270,000000FF,?,0000003F,?,?,?,0027121C,000000FF,?,0000003F,?,?), ref: 001DBC36

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: d828872d07044bd1935e90f49ef4fc2207ae215c1d758b4a1fe50f0996fb1e29
Instruction ID: 21dc0297d147c34f6611e7bfecb98b92cc52a8f9d7d8d4f6af4ff10bc3e73c01
Opcode Fuzzy Hash: d828872d07044bd1935e90f49ef4fc2207ae215c1d758b4a1fe50f0996fb1e29
Instruction Fuzzy Hash: 8431D070908215EFCB14DF68ECC1829BBB8FF5535071642ABE46AEB3A2DB309D50DB50

Function 0021CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0021CE89
GetLastError.KERNEL32(?,00000000), ref: 0021CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0021CEFE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 21f07c5930184d4d79d2738c08cd349e29dc85ccf3ac85ef1437d783dac49f6a
Instruction ID: d93c27a5d738076be3d89cbe0218b77e89b68b834978f2c6b04257323a110b30
Opcode Fuzzy Hash: 21f07c5930184d4d79d2738c08cd349e29dc85ccf3ac85ef1437d783dac49f6a
Instruction Fuzzy Hash: 5521EDB9550306ABDB30CFA5D948BA7B7FCEB20314F30442EE642A2151E770EE958B90

Function 00215C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00215CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00215D17
FindClose.KERNEL32(?), ref: 00215D5F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 2df60f12420a0027020514dfbfa63dc55e2c8bf218265e60e32699aec5f9014d
Instruction ID: 9c4650a7a2e6946eb382a4bc40d568791c7f48cc1215d7159338863de9dd8d0d
Opcode Fuzzy Hash: 2df60f12420a0027020514dfbfa63dc55e2c8bf218265e60e32699aec5f9014d
Instruction Fuzzy Hash: 9D51AA74614602DFC714CF28D484E96B7E4FF5A324F14859EE95A8B3A2CB30ED94CB91

Function 001D2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 001D271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001D2724
UnhandledExceptionFilter.KERNEL32(?), ref: 001D2731

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2d4a8eba42ee3b09dcad8b08c50ab28a9c4abe441f968da1fb7cfb7164d7fb15
Instruction ID: edd8bf87717ccd807371e6eeb41c7a66a4d3348010a70bba93d076d86ea1b94d
Opcode Fuzzy Hash: 2d4a8eba42ee3b09dcad8b08c50ab28a9c4abe441f968da1fb7cfb7164d7fb15
Instruction Fuzzy Hash: 7931D57590122CABCB21DF64DC88B9DBBB8BF18310F5041EAE81CA7260E7349F818F44

Function 002151CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002151DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00215238
SetErrorMode.KERNEL32(00000000), ref: 002152A1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 248456faf97f30066e1fd914f8e8fd3a039fb0335699981893ac5e5026c5b924
Instruction ID: 617a9c293577397ee96f11dd2c5ac7d5c0ebc24e1b78228fdd4002afb0c85dc1
Opcode Fuzzy Hash: 248456faf97f30066e1fd914f8e8fd3a039fb0335699981893ac5e5026c5b924
Instruction Fuzzy Hash: FF315E75A10618DFDB00DF54D888EADBBF4FF59314F148099E809AB3A2DB31E855CBA0

Function 002016C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 001BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 001C0668
Part of subcall function 001BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 001C0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0020170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0020173A
GetLastError.KERNEL32 ref: 0020174A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 4af0956a6bd8fb8b9287b7f61b96a39387cf13328c260faa3e72fbfb7acdb9ef
Instruction ID: bb8c09450defa472e8cc5c9ea9cdfae90cd28d74d1116be22cb9db825874a1d0
Opcode Fuzzy Hash: 4af0956a6bd8fb8b9287b7f61b96a39387cf13328c260faa3e72fbfb7acdb9ef
Instruction Fuzzy Hash: BE11A3B2514305AFD7189F54ECC6EABB7BDEB44714B20852EF05657291EB70FC518B20

Function 0020D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0020D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0020D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0020D650

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 853e2c15d9b468a9efea9e9ead3f711683a809825a78c20ad6613b609686fb3e
Instruction ID: dad32ec43a31b319fddf313acd8cff8df35b9e42cf3fe7dea6ab5c41e6895a6c
Opcode Fuzzy Hash: 853e2c15d9b468a9efea9e9ead3f711683a809825a78c20ad6613b609686fb3e
Instruction Fuzzy Hash: 9D113C75E05228BBDB108F95AC49FAFBBBCEB45B50F108156F904E7290D6704A058BA1

Function 00201663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0020168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 002016A1
FreeSid.ADVAPI32(?), ref: 002016B1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 88595cd414c060f594c4efa0dadfe05d0038f800dcb2edcbc2d2948dd53d8d7e
Instruction ID: d32da7ab5b180f30755bdde0ca4c5e8356aa1eb5ec197fafddd0d4468b94ba03
Opcode Fuzzy Hash: 88595cd414c060f594c4efa0dadfe05d0038f800dcb2edcbc2d2948dd53d8d7e
Instruction Fuzzy Hash: 27F0F47195030DFBDB00DFE49D89AAEBBBCEB08704F504565E501E2181E774AA548B50

Function 001C4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(001D28E9,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002,00000000,?,001D28E9), ref: 001C4D09
TerminateProcess.KERNEL32(00000000,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002,00000000,?,001D28E9), ref: 001C4D10
ExitProcess.KERNEL32 ref: 001C4D22

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 49cb3d25cf6470a3d90b4c40f87801baa2f342c2c01cb9897efd847411b79a77
Instruction ID: 5d581dc1e8db5f4484ea48b1ae4c77adb69967b07bf9ec95234ce717565846ee
Opcode Fuzzy Hash: 49cb3d25cf6470a3d90b4c40f87801baa2f342c2c01cb9897efd847411b79a77
Instruction Fuzzy Hash: 1BE0B631004148ABCF11BFA4ED1EFA83B69EB61791B204458FC1A9A222CB35DE52DB80

Function 001FD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 001FD28C

Strings

X64, xrefs: 001FD2A8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: ce6caba0c6e19cc08e2af4a3845ba62af2450b035590facaed04b53aaa5cd0f4
Instruction ID: 8c14c3ed465bc62afc526d4b3b8873187e64da8f83db63c8a16dbb481f8011ad
Opcode Fuzzy Hash: ce6caba0c6e19cc08e2af4a3845ba62af2450b035590facaed04b53aaa5cd0f4
Instruction Fuzzy Hash: 96D0C9B480111DEACB98DB90ECC8DEAB37CBB04305F100151F106A2000DB3095488F10

Function 001CCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 8ab01c4104e374e8732abe44f148626be861888778461f35c9fece5887b7a97b
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 28020B71E002199BDF14CFA9C990BADBBF1EF58314F25816ED819E7384D731AE418B94

Function 001ACAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 001F0C40
p#', xrefs: 001ACF7F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#'
API String ID: 0-4107862598
Opcode ID: 42c9a3698a6965715878c88d3df804e441ce18ac2438a00588a2bd9fe75211c6
Instruction ID: 5d0423c620758dc5f7f04d2d5ad405551fe041061ff9fbc6c6e862e93c58ba9c
Opcode Fuzzy Hash: 42c9a3698a6965715878c88d3df804e441ce18ac2438a00588a2bd9fe75211c6
Instruction Fuzzy Hash: E432AE78900218DFCF19DF94C985AFDB7B5FF1A304F148059E906AB292DB35AE45CBA0

Function 002168EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00216918
FindClose.KERNEL32(00000000), ref: 00216961

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c865e4cf9101416c94860981b128995e5a04ce8915bcd8b1920f9097a14beaff
Instruction ID: 29e32965a12b6e78be840ffbc4dde07da4fff68eb31308961b9d39e617fcdbe7
Opcode Fuzzy Hash: c865e4cf9101416c94860981b128995e5a04ce8915bcd8b1920f9097a14beaff
Instruction Fuzzy Hash: CC1190356142119FC710DF29D888A1ABBE5FF95328F14C6A9E8698F6A2C730EC45CBD1

Function 002137B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00224891,?,?,00000035,?), ref: 002137E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00224891,?,?,00000035,?), ref: 002137F4

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 052516ff0cb05bb2ae1de9423626a0c57ea9fa708a753568a679c7218ff500ba
Instruction ID: fe8f5b77c62a95b1afb6f6212dad4d3252ef2565a1828f7eb0c0163313319579
Opcode Fuzzy Hash: 052516ff0cb05bb2ae1de9423626a0c57ea9fa708a753568a679c7218ff500ba
Instruction Fuzzy Hash: 38F0E5B16043292AE72057669C4DFEB7AEEEFC5761F100175F509E22C1DA609D44C7B0

Function 002010BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002011FC), ref: 002010D4
CloseHandle.KERNEL32(?,?,002011FC), ref: 002010E9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 6d78cb657dca587a640744a19f22817b33e7fd28b96dbdcb84e47cb02f4f699c
Instruction ID: 96f45a5e9f3059a69712f281130f6bff536a53a2fd2b79ea1967b26067de9a85
Opcode Fuzzy Hash: 6d78cb657dca587a640744a19f22817b33e7fd28b96dbdcb84e47cb02f4f699c
Instruction Fuzzy Hash: FEE0BF72018611AEE7252B51FC09EB777E9EB04310B24882DF5A5904B1DB62ACA1DB50

Function 001ABF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#', xrefs: 001F07CE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#'
API String ID: 3964851224-2954064712
Opcode ID: bed0bdbb0920cf57d3968ece195938d57c9f4fd77753766b2ef41cccec28292d
Instruction ID: fc0c0d47572dcb29b3de3d714d966bbe1018cfe6d5efd2dd205080830d0bd796
Opcode Fuzzy Hash: bed0bdbb0920cf57d3968ece195938d57c9f4fd77753766b2ef41cccec28292d
Instruction Fuzzy Hash: 27A26A78A08301CFD715DF28C480B6AB7E1BF9A304F15896DE99A8B352D771EC45CB92

Function 001D676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001D6766,?,?,00000008,?,?,001DFEFE,00000000), ref: 001D6998

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d780402fa03b9db5b4bff84bf46aefb4f111b376be138f7fe0cfe9541c89c63d
Instruction ID: 17dfaa8ee89cc736d2cb6518c6200ee80428fd247b447a75cc05b1a686371156
Opcode Fuzzy Hash: d780402fa03b9db5b4bff84bf46aefb4f111b376be138f7fe0cfe9541c89c63d
Instruction Fuzzy Hash: 7EB12931610609DFD719CF28C48AB657BA0FF45368F25865AE8D9CF3A2C335E991CB40

Function 001BB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 001F851F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: bc096c4ff300b7d280b341aa890f34ff4d6203cc6158b90da929ca3cbb343c13
Instruction ID: 07c2c1a2b2d024d35c2158c3fbccca0b85ae0178148a3f56a9fc14dbc89ec8d0
Opcode Fuzzy Hash: bc096c4ff300b7d280b341aa890f34ff4d6203cc6158b90da929ca3cbb343c13
Instruction Fuzzy Hash: FF126E759042299BCB24CF58C8806FEB7F5FF48710F1581AAE949EB255DB709E81CF90

Function 0021EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0021EABD

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: a69ee3af3347d0d357ee611bea1a8f192f072e695fdb37208e96cc1259299066
Instruction ID: 5688199cc2c4b53f9a12655738fddc612fda5e0c19db524d22f4695e31491a54
Opcode Fuzzy Hash: a69ee3af3347d0d357ee611bea1a8f192f072e695fdb37208e96cc1259299066
Instruction Fuzzy Hash: 6DE04F362102049FC720EF69E845E9AF7EDAFA9760F018416FC4AD7351DBB0E8808BD1

Function 001C09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,001C03EE), ref: 001C09DA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 231a6301ffc9a097b592d175daba5b9513705fea8af5de6fb81efa8a38c5b0d0
Instruction ID: cff4e9b430a996a62b54c1661a9a5e13093a01701f4dd965141fd223ce89d0f5
Opcode Fuzzy Hash: 231a6301ffc9a097b592d175daba5b9513705fea8af5de6fb81efa8a38c5b0d0
Instruction Fuzzy Hash:

Function 001C781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 001C798B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: ef6d64894bc2e68ca303afb765978a239bb359232d67b0c6ad0270ac6664d0a6
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 2C51887160C7469BDF388568889EFBE63999B32354F18050DEA82D72C2C7E1DE01DF52

Function 00212046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&', xrefs: 00212053

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: 0&'
API String ID: 0-3187542733
Opcode ID: e520170a088ee08428628f2262ce84f68fae27c04b5400c70983556d47eb7c4d
Instruction ID: 55cd26889d247b606513b2f74948503e7861f460844899b986c83c313ef477a0
Opcode Fuzzy Hash: e520170a088ee08428628f2262ce84f68fae27c04b5400c70983556d47eb7c4d
Instruction Fuzzy Hash: 3321A832620511CBD728CF79C8226BA73E5A764310F15862EE4A7C37D1DE35A948CB80

Function 001D6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0742b293e993c2f5f566309a13f24aee2cffb100980a77d20e8639443dfe27
Instruction ID: 43265d7dd9c314506295b720e7df95a94cc320638f65fbf10c016ac888defac0
Opcode Fuzzy Hash: cd0742b293e993c2f5f566309a13f24aee2cffb100980a77d20e8639443dfe27
Instruction Fuzzy Hash: 15326726D29F018DD7239635EC26336A249AFB73C5F55C737F81AB5AA6EB28D4C34100

Function 001BCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a48e7c58985221c2fb29e14fe8414674a99bf37538ead51f1beb9167cf6114a
Instruction ID: fb7cdd07ad3e76c96ecba25d71ef3ee9bfa25ad92a7022bb1e5c6a88eeb43c69
Opcode Fuzzy Hash: 8a48e7c58985221c2fb29e14fe8414674a99bf37538ead51f1beb9167cf6114a
Instruction Fuzzy Hash: 91324931A0411D8BCF28CF69C6946BE7BA1EF45354F29856AD65ACB291E330DD81FBC0

Function 001A7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df31b308ca66c861af67afb094fd8ef08273b0ba734c84366187adb2cfb8e7f
Instruction ID: 5e4d272acc933e195ce8b7bc6686c5e259a76d3b1a4a74c809bd60aa4e8f2172
Opcode Fuzzy Hash: 9df31b308ca66c861af67afb094fd8ef08273b0ba734c84366187adb2cfb8e7f
Instruction Fuzzy Hash: 6E22D1B4A00A0ADFDF14CF65C841AAEB3F2FF59304F144529E816A7291EB35DE51CB50

Function 001A91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107a2f4d934e9f45296f408108a7755eb358a0bbc2e7ceebb93847bccc6d5343
Instruction ID: fb78dcb13bfeef894712a706b7ca6f8d9951c06c1729bd4b660f603ccdb57853
Opcode Fuzzy Hash: 107a2f4d934e9f45296f408108a7755eb358a0bbc2e7ceebb93847bccc6d5343
Instruction Fuzzy Hash: 7C02B5B0A00605EBDF04DF65D881AAEB7F1FF54300F218169E816DB291EB71EA61CB91

Function 001D9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c36f1986a93d4c9bf9f798ce034ef13d7b8523d399f608124385c8d210aa19
Instruction ID: 29b3989c06ee85851daa09e8b2cbaf7424ce3e6fa1520a30a4e3395c8a8fe661
Opcode Fuzzy Hash: 61c36f1986a93d4c9bf9f798ce034ef13d7b8523d399f608124385c8d210aa19
Instruction Fuzzy Hash: 30B10325D2AF404DC3239B399835336BA5CAFBB6D5F91D71BFC1674D22EB2286834180

Function 001C1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 253c9070496d09d604e6dd9b9bf1cdd781039aebd69195dfe741222bf210e8a7
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 169177731480A35ADB2E46798575A7DFFE15A633A131A079DE4F3CA1C2FF20C964D620

Function 001C1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: af3f6f5c79160b8235ccf080e85d59d33bd72a7081786a96eda3e994198126e4
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 4B9158732090A34ADB6D4639857593DFFE15AA33A131E079EE4F2CA1C6EF34C568D620

Function 001C19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 63950f38320d94c1f47708b3e31c7606d7eba0d1ff6de5c4eaac62648d325873
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: BC9133722490E359DB2D427A8574A3DFEF15AA33A131A079DD4F2CB1C2FF24C965DA20

Function 001C7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ac624e15013c3b3d0f9260cfa293ec11b91f3cd7d56532e038ff3a177e1e27
Instruction ID: 98f7a75950de008167235ba253dbe6253710505edb227f3333476a1f8eecbf42
Opcode Fuzzy Hash: a0ac624e15013c3b3d0f9260cfa293ec11b91f3cd7d56532e038ff3a177e1e27
Instruction Fuzzy Hash: 74615B71208746A7DB38A9688996FBE2394DF71710F18091EE842DB2C1D7D1DE42CF56

Function 001C7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6404f061e592b13724d7f9a8839f09cdbeb4a614d76f2410370f904b395e0832
Instruction ID: aeae8f6996d3035661b91101a9b129cc793b82599e4fdb93aeb7b4fd6c204f4c
Opcode Fuzzy Hash: 6404f061e592b13724d7f9a8839f09cdbeb4a614d76f2410370f904b395e0832
Instruction Fuzzy Hash: 1461793220870967DA395AE85892FBF2394AF72784F10095EF843CB2C1DBD2ED42CE55

Function 001C1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: bbfaf363eae6fda44ebfa0d87799d1287c94154ecf47271d502180fae9271761
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: D881747364C0A359EB2D427A8534A3EFFE15AA33A531A079DD4F2CA1C3EF24C554E620

Function 00222ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00222B30
DeleteObject.GDI32(00000000), ref: 00222B43
DestroyWindow.USER32 ref: 00222B52
GetDesktopWindow.USER32 ref: 00222B6D
GetWindowRect.USER32(00000000), ref: 00222B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00222CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00222CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222CF8
GetClientRect.USER32(00000000,?), ref: 00222D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00222D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222DA8
GlobalFree.KERNEL32(00000000), ref: 00222DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0023FC38,00000000), ref: 00222DDB
GlobalFree.KERNEL32(00000000), ref: 00222DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00222E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00222E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0022303F

Strings

, xrefs: 00222FC5
DISPLAY, xrefs: 00222EA2
static, xrefs: 00222D3A, 00222E91
AutoIt v3, xrefs: 00222CF2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 4cd75c905d07cc2f72685115ee6df76e1804fafda7444eb91b329df5cbb478ce
Instruction ID: 686869a10f0ba19a1114f1d4c570afb4097dce23422451615a12f5c2d337f72a
Opcode Fuzzy Hash: 4cd75c905d07cc2f72685115ee6df76e1804fafda7444eb91b329df5cbb478ce
Instruction Fuzzy Hash: DB028975910215EFDB14DFA4EC89EAE7BB9EF49310F148158F919AB2A1CB70AD10CB60

Function 002370D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0023712F
GetSysColorBrush.USER32(0000000F), ref: 00237160
GetSysColor.USER32(0000000F), ref: 0023716C
SetBkColor.GDI32(?,000000FF), ref: 00237186
SelectObject.GDI32(?,?), ref: 00237195
InflateRect.USER32(?,000000FF,000000FF), ref: 002371C0
GetSysColor.USER32(00000010), ref: 002371C8
CreateSolidBrush.GDI32(00000000), ref: 002371CF
FrameRect.USER32(?,?,00000000), ref: 002371DE
DeleteObject.GDI32(00000000), ref: 002371E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00237230
FillRect.USER32(?,?,?), ref: 00237262
GetWindowLongW.USER32(?,000000F0), ref: 00237284

Part of subcall function 002373E8: GetSysColor.USER32(00000012), ref: 00237421
Part of subcall function 002373E8: SetTextColor.GDI32(?,?), ref: 00237425
Part of subcall function 002373E8: GetSysColorBrush.USER32(0000000F), ref: 0023743B
Part of subcall function 002373E8: GetSysColor.USER32(0000000F), ref: 00237446
Part of subcall function 002373E8: GetSysColor.USER32(00000011), ref: 00237463
Part of subcall function 002373E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00237471
Part of subcall function 002373E8: SelectObject.GDI32(?,00000000), ref: 00237482
Part of subcall function 002373E8: SetBkColor.GDI32(?,00000000), ref: 0023748B
Part of subcall function 002373E8: SelectObject.GDI32(?,?), ref: 00237498
Part of subcall function 002373E8: InflateRect.USER32(?,000000FF,000000FF), ref: 002374B7
Part of subcall function 002373E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002374CE
Part of subcall function 002373E8: GetWindowLongW.USER32(00000000,000000F0), ref: 002374DB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: f6e72d36f88c1b5c04ef2536bdf91d2b99737e62dd4be6cacaf9d82547f80def
Instruction ID: b511dbd960be1cde4e054c8bc4e9c9dc3c4f2488ac748e6d2eb9bb501c64701f
Opcode Fuzzy Hash: f6e72d36f88c1b5c04ef2536bdf91d2b99737e62dd4be6cacaf9d82547f80def
Instruction Fuzzy Hash: 3CA1A2B2018302AFDB109F60EC4CE5B7BA9FF49320F200A19F9A6A61E1D771E955DF51

Function 001B8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 001B8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 001F6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 001F6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 001F6F43

Part of subcall function 001B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001B8BE8,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001B8FC5

SendMessageW.USER32(?,00001053), ref: 001F6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 001F6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 001F6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 001F6FB7

Strings

0, xrefs: 001F6DCF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 3291e4fa32f410c64a84e626aa5957f3c70c30b892fda41254f43cb1452a4f1a
Instruction ID: c056b377093a0e3f118064736cfb8ce261ac66dd70aa6a8cd61655cb34217e97
Opcode Fuzzy Hash: 3291e4fa32f410c64a84e626aa5957f3c70c30b892fda41254f43cb1452a4f1a
Instruction Fuzzy Hash: 64128B35200205DFDB29DF28D898BBAB7B5FF45700F144469F6899B261CB31ECA2DB91

Function 00222711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0022273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0022286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 002228A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 002228B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00222900
GetClientRect.USER32(00000000,?), ref: 0022290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00222955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00222964
GetStockObject.GDI32(00000011), ref: 00222974
SelectObject.GDI32(00000000,00000000), ref: 00222978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00222988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00222991
DeleteDC.GDI32(00000000), ref: 0022299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002229C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 002229DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00222A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00222A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00222A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00222A77
GetStockObject.GDI32(00000011), ref: 00222A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00222A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00222A97

Strings

DISPLAY, xrefs: 0022295A
msctls_progress32, xrefs: 00222A13
static, xrefs: 0022294F, 00222A71
AutoIt v3, xrefs: 002228F8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4c9b10905ee1f09c8f155552650daa5242e978293b0cc52bdfe6347dc0677476
Instruction ID: 61814d216b7f50a03b2b5b1149070a3f19d0e55aee78919100010687832f36d6
Opcode Fuzzy Hash: 4c9b10905ee1f09c8f155552650daa5242e978293b0cc52bdfe6347dc0677476
Instruction Fuzzy Hash: 36B15A75A10215BFEB14DFA8EC8AFAABBA9EF09710F104154F914E7290D774E950CBA0

Function 00214ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00214AED
GetDriveTypeW.KERNEL32(?,0023CB68,?,\\.\,0023CC08), ref: 00214BCA
SetErrorMode.KERNEL32(00000000,0023CB68,?,\\.\,0023CC08), ref: 00214D36

Strings

ATAPI, xrefs: 00214C91
Network, xrefs: 00214C02
SSD, xrefs: 00214C4A
Fixed, xrefs: 00214C09
SCSI, xrefs: 00214C8A
SAS, xrefs: 00214CC9
1394, xrefs: 00214C9F
FileBackedVirtual, xrefs: 00214CEC
RAID, xrefs: 00214CBB
iSCSI, xrefs: 00214CC2
Removable, xrefs: 00214C10, 00214C15
Unknown, xrefs: 00214BED, 00214C83
PhysicalDrive, xrefs: 00214B76
RAMDisk, xrefs: 00214BF4
ATA, xrefs: 00214C98
USB, xrefs: 00214CB4
Virtual, xrefs: 00214CE5
CDROM, xrefs: 00214BFB
\\.\, xrefs: 00214B3F
Fibre, xrefs: 00214CAD
SATA, xrefs: 00214CD0
SSA, xrefs: 00214CA6
MMC, xrefs: 00214CDE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: d3dad2733ce46b225d2c01f8213b11accc195d512cf1bd2a4169a588c14e24f9
Instruction ID: 10c4ae0fa281581fa916301617073e8ffb3b7c8777c09a99d1ca2a09c73809c6
Opcode Fuzzy Hash: d3dad2733ce46b225d2c01f8213b11accc195d512cf1bd2a4169a588c14e24f9
Instruction Fuzzy Hash: 9961C334635206DBCB04FF24CA85DE9B7E0AB66744F244116F80EAB291DB71EDE1DB81

Function 002373E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00237421
SetTextColor.GDI32(?,?), ref: 00237425
GetSysColorBrush.USER32(0000000F), ref: 0023743B
GetSysColor.USER32(0000000F), ref: 00237446
CreateSolidBrush.GDI32(?), ref: 0023744B
GetSysColor.USER32(00000011), ref: 00237463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00237471
SelectObject.GDI32(?,00000000), ref: 00237482
SetBkColor.GDI32(?,00000000), ref: 0023748B
SelectObject.GDI32(?,?), ref: 00237498
InflateRect.USER32(?,000000FF,000000FF), ref: 002374B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002374CE
GetWindowLongW.USER32(00000000,000000F0), ref: 002374DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0023752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00237554
InflateRect.USER32(?,000000FD,000000FD), ref: 00237572
DrawFocusRect.USER32(?,?), ref: 0023757D
GetSysColor.USER32(00000011), ref: 0023758E
SetTextColor.GDI32(?,00000000), ref: 00237596
DrawTextW.USER32(?,002370F5,000000FF,?,00000000), ref: 002375A8
SelectObject.GDI32(?,?), ref: 002375BF
DeleteObject.GDI32(?), ref: 002375CA
SelectObject.GDI32(?,?), ref: 002375D0
DeleteObject.GDI32(?), ref: 002375D5
SetTextColor.GDI32(?,?), ref: 002375DB
SetBkColor.GDI32(?,?), ref: 002375E5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 1b27d1d72eff450567dccf4921be1a21d5a1ab71fe9d22f8aca9ed4d5b581cb3
Instruction ID: 37b24b3c9df52656fbbeab6d4d68295b361bb37a71d5faed7ea586e9262f49e2
Opcode Fuzzy Hash: 1b27d1d72eff450567dccf4921be1a21d5a1ab71fe9d22f8aca9ed4d5b581cb3
Instruction Fuzzy Hash: BB6181B2910218AFDF109FA4EC49EEE7FB9EB08320F214115F915BB2A1D770A940DF90

Function 00230FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00231128
GetDesktopWindow.USER32 ref: 0023113D
GetWindowRect.USER32(00000000), ref: 00231144
GetWindowLongW.USER32(?,000000F0), ref: 00231199
DestroyWindow.USER32(?), ref: 002311B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 002311ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0023120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0023121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00231232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00231245
IsWindowVisible.USER32(00000000), ref: 002312A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 002312BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 002312D0
GetWindowRect.USER32(00000000,?), ref: 002312E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0023130E
GetMonitorInfoW.USER32(00000000,?), ref: 00231328
CopyRect.USER32(?,?), ref: 0023133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 002313AA

Strings

0, xrefs: 002310D3
(, xrefs: 0023131B
tooltips_class32, xrefs: 002311E6

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 5c3c1d295425cffdbc86a9fb901ac5ff8d81fef63487d28a7711246d0d85b7ee
Instruction ID: d436c9846e6ef7e8132f8106398c3304ed9cfd8ef2f09277e5c255c936cfeff8
Opcode Fuzzy Hash: 5c3c1d295425cffdbc86a9fb901ac5ff8d81fef63487d28a7711246d0d85b7ee
Instruction Fuzzy Hash: E4B18EB1618341AFD704DF64D889B6BBBE4FF85350F008918F999AB2A1C771E864CF91

Function 001B8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001B8968
GetSystemMetrics.USER32(00000007), ref: 001B8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001B899B
GetSystemMetrics.USER32(00000008), ref: 001B89A3
GetSystemMetrics.USER32(00000004), ref: 001B89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 001B89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 001B89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 001B8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 001B8A3C
GetClientRect.USER32(00000000,000000FF), ref: 001B8A5A
GetStockObject.GDI32(00000011), ref: 001B8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 001B8A81

Part of subcall function 001B912D: GetCursorPos.USER32(?), ref: 001B9141
Part of subcall function 001B912D: ScreenToClient.USER32(00000000,?), ref: 001B915E
Part of subcall function 001B912D: GetAsyncKeyState.USER32(00000001), ref: 001B9183
Part of subcall function 001B912D: GetAsyncKeyState.USER32(00000002), ref: 001B919D

SetTimer.USER32(00000000,00000000,00000028,001B90FC), ref: 001B8AA8

Strings

AutoIt v3 GUI, xrefs: 001B8A20

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5de315fb798928550df76f2799ae36b18ed0e2534e728675da1ac2cc1d405786
Instruction ID: 8e5a2f5c900b125b82d588988ddd1c9a869056dfa206c66fb40033e9ce682ccd
Opcode Fuzzy Hash: 5de315fb798928550df76f2799ae36b18ed0e2534e728675da1ac2cc1d405786
Instruction Fuzzy Hash: 09B16875A0020AEFDF14DFA8DC49BEA3BB5FB48714F114229FA19A7290DB30A851CB51

Function 00200D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00201114
Part of subcall function 002010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201120
Part of subcall function 002010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 0020112F
Part of subcall function 002010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201136
Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0020114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00200DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00200E29
GetLengthSid.ADVAPI32(?), ref: 00200E40
GetAce.ADVAPI32(?,00000000,?), ref: 00200E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00200E96
GetLengthSid.ADVAPI32(?), ref: 00200EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00200EB5
HeapAlloc.KERNEL32(00000000), ref: 00200EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00200EDD
CopySid.ADVAPI32(00000000), ref: 00200EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00200F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00200F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00200F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200F6E
HeapFree.KERNEL32(00000000), ref: 00200F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200F7E
HeapFree.KERNEL32(00000000), ref: 00200F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200F8E
HeapFree.KERNEL32(00000000), ref: 00200F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00200FA1
HeapFree.KERNEL32(00000000), ref: 00200FA8

Part of subcall function 00201193: GetProcessHeap.KERNEL32(00000008,00200BB1,?,00000000,?,00200BB1,?), ref: 002011A1
Part of subcall function 00201193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00200BB1,?), ref: 002011A8
Part of subcall function 00201193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00200BB1,?), ref: 002011B7

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1863bef2bdb624ab711e19a8a823016a52501181bd68cdb90a0d1312897d7872
Instruction ID: 61583c0cfe4187ffda9e331a9c889b46dfaf4c7288ea6da1ecd60ca0d73e54c5
Opcode Fuzzy Hash: 1863bef2bdb624ab711e19a8a823016a52501181bd68cdb90a0d1312897d7872
Instruction Fuzzy Hash: E671617191030AEBEF209FA4DC88FAEBBB8BF05301F144125F959F6192DB719915DB60

Function 0022C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0023CC08,00000000,?,00000000,?,?), ref: 0022C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0022C5A4
_wcslen.LIBCMT ref: 0022C5F4
_wcslen.LIBCMT ref: 0022C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0022C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0022C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0022C84D
RegCloseKey.ADVAPI32(?), ref: 0022C881
RegCloseKey.ADVAPI32(00000000), ref: 0022C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0022C960

Strings

REG_DWORD, xrefs: 0022C804
REG_MULTI_SZ, xrefs: 0022C6F5
REG_BINARY, xrefs: 0022C913
REG_EXPAND_SZ, xrefs: 0022C5CD
REG_QWORD, xrefs: 0022C8C3
REG_SZ, xrefs: 0022C644

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: ffe82eb932732207f36f024ff2bcd6609329dd05960b9035f76787714d6feb2f
Instruction ID: 1429302d8e0b13586594da98bd2bb7105ea513dbb94bd88f324812a03af48f9f
Opcode Fuzzy Hash: ffe82eb932732207f36f024ff2bcd6609329dd05960b9035f76787714d6feb2f
Instruction Fuzzy Hash: AB128939614211AFCB14EF14D891B2AB7E5FF89314F14885CF88A9B3A2DB31ED51CB81

Function 0023091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002309C6
_wcslen.LIBCMT ref: 00230A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00230A54
_wcslen.LIBCMT ref: 00230A8A
_wcslen.LIBCMT ref: 00230B06
_wcslen.LIBCMT ref: 00230B81

Part of subcall function 001BF9F2: _wcslen.LIBCMT ref: 001BF9FD

Part of subcall function 00202BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00202BFA

Strings

GETSELECTED, xrefs: 00230C4E
COLLAPSE, xrefs: 00230B01, 00230B1C
EXISTS, xrefs: 00230B7C, 00230B97
UNCHECK, xrefs: 00230D3E
GETITEMCOUNT, xrefs: 00230C1E
SELECT, xrefs: 00230D11
CHECK, xrefs: 00230A85, 00230AA0
GETTOTALCOUNT, xrefs: 002309F2, 00230A17
GETTEXT, xrefs: 00230C97
ISCHECKED, xrefs: 00230CE1
EXPAND, xrefs: 00230BF8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 7c264624c67ab1b392c934a0ea6fb03a96a00f6669b0420345182ec13446284f
Instruction ID: 03415ecfbf776924d52294a645396b7bde6c9765928c4c07d80223a6de930af7
Opcode Fuzzy Hash: 7c264624c67ab1b392c934a0ea6fb03a96a00f6669b0420345182ec13446284f
Instruction Fuzzy Hash: 39E1C2752283028FC714EF24C4A092AB7E2FF99718F14495DF8969B3A2D730ED55CB91

Function 0022C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
_wcslen.LIBCMT ref: 0022C9F1
_wcslen.LIBCMT ref: 0022CA68
_wcslen.LIBCMT ref: 0022CA9E
_wcslen.LIBCMT ref: 0022CAF9
_wcslen.LIBCMT ref: 0022CB2F
_wcslen.LIBCMT ref: 0022CB7F

Strings

HKEY_CLASSES_ROOT, xrefs: 0022CAF3, 0022CAF8
HKCR, xrefs: 0022CB29, 0022CB2E
HKCU, xrefs: 0022CBCE
HKEY_CURRENT_USER, xrefs: 0022CBBD
HKLM, xrefs: 0022CA98, 0022CA9D
HKEY_CURRENT_CONFIG, xrefs: 0022CB79, 0022CB7E
HKCC, xrefs: 0022CBAC
HKU, xrefs: 0022CBF0
HKEY_LOCAL_MACHINE, xrefs: 0022CA62, 0022CA67
HKEY_USERS, xrefs: 0022CBDF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 16bfeceb72cb9c7f5b3453242cbf9308e6e7316d0b6af8bf2b337b34ef81d3ea
Instruction ID: 91db74f0268630b7acfb7a9994e6a7f4c502a21fd7bcaaf78f883b9793619e8d
Opcode Fuzzy Hash: 16bfeceb72cb9c7f5b3453242cbf9308e6e7316d0b6af8bf2b337b34ef81d3ea
Instruction Fuzzy Hash: AB71E23263413BABCB20DEB8EC516BE3391AF71758B300129F85697284E771CDA5C3A0

Function 0023833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0023835A
_wcslen.LIBCMT ref: 0023836E
_wcslen.LIBCMT ref: 00238391
_wcslen.LIBCMT ref: 002383B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 002383F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0023361A,?), ref: 0023844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00238487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 002384CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00238501
FreeLibrary.KERNEL32(?), ref: 0023850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0023851D
DestroyIcon.USER32(?), ref: 0023852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00238549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00238555

Strings

.icl, xrefs: 00238368
.exe, xrefs: 00238388
.dll, xrefs: 002383AB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 09ebf17fd616c62cdf8819fda6800455cee94434bebd22324d7993e2fbc4a623
Instruction ID: 3eab52cffe4c29065a86d5e6cd276924f9ca69efbafdc5ca5292a60415f29fa2
Opcode Fuzzy Hash: 09ebf17fd616c62cdf8819fda6800455cee94434bebd22324d7993e2fbc4a623
Instruction Fuzzy Hash: 6961F1B1924316BBEB14DF64DC45BBE77A8BB18710F104209F915EA1D1DBB4E9A0CBA0

Function 001A7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

", xrefs: 001E5153
#cs, xrefs: 001A7873, 001A78C5
Cannot parse #include, xrefs: 001E5279
Unterminated group of comments, xrefs: 001E528C
#requireadmin, xrefs: 001A77FF
Bad directive syntax error, xrefs: 001E519A
#comments-end, xrefs: 001A78D9
#comments-start, xrefs: 001A785F, 001A78B1
#pragma compile, xrefs: 001A77D3
#include, xrefs: 001A7847
#OnAutoItStartRegister, xrefs: 001A7817
#notrayicon, xrefs: 001A77E7
#include-once, xrefs: 001A782F
#ce, xrefs: 001A78ED
', xrefs: 001E5169

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 8c826529624e7d3a69db922cca08f56558531293f5b6eb1a21876d50f8153af3
Instruction ID: 35fa062fcf8448b78b0fc407e7e1940a48504fb04a4922f24e76923f029d797b
Opcode Fuzzy Hash: 8c826529624e7d3a69db922cca08f56558531293f5b6eb1a21876d50f8153af3
Instruction Fuzzy Hash: 3B814B75A04605BBDB24BFA0DC46FBF37A9AF26300F044024F904AB1D6EB70DA51D7A1

Function 00213E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00213EF8
_wcslen.LIBCMT ref: 00213F03
_wcslen.LIBCMT ref: 00213F5A
_wcslen.LIBCMT ref: 00213F98
GetDriveTypeW.KERNEL32(?), ref: 00213FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0021401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00214059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00214087

Strings

set cd door , xrefs: 00214028
close cd wait, xrefs: 00214072
open, xrefs: 00213F54, 00213F59
closed, xrefs: 00213F08, 00213F2D, 00213F46, 00213F7E, 00213F97
wait, xrefs: 00214044
close, xrefs: 00213EFE, 00213F18
type cdaudio alias cd wait, xrefs: 00214001
open , xrefs: 00213FE5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 696eeb5eaf5681a439ed41cc0a7f749a7eccf4eb9772dcf31e736ad8508baed0
Instruction ID: cf12e9beb25b9e638f51331701f267e1334d5b95e4eb4ca4a7204747791a66c3
Opcode Fuzzy Hash: 696eeb5eaf5681a439ed41cc0a7f749a7eccf4eb9772dcf31e736ad8508baed0
Instruction Fuzzy Hash: 1E71E2326142129FC710EF34C8808AAB7F5EFB9758F10492DF89597251EB31DE96CB91

Function 00205A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00205A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00205A40
SetWindowTextW.USER32(?,?), ref: 00205A57
GetDlgItem.USER32(?,000003EA), ref: 00205A6C
SetWindowTextW.USER32(00000000,?), ref: 00205A72
GetDlgItem.USER32(?,000003E9), ref: 00205A82
SetWindowTextW.USER32(00000000,?), ref: 00205A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00205AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00205AC3
GetWindowRect.USER32(?,?), ref: 00205ACC
_wcslen.LIBCMT ref: 00205B33
SetWindowTextW.USER32(?,?), ref: 00205B6F
GetDesktopWindow.USER32 ref: 00205B75
GetWindowRect.USER32(00000000), ref: 00205B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00205BD3
GetClientRect.USER32(?,?), ref: 00205BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00205C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00205C2F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 525d827b6180b2efaf2cb37344d015af513f467d5d003c052d4103516c540655
Instruction ID: 74b109b322f2f75766aff1f75cb2ddcd0d6b2386d16a14bc8f6692a7bca6faf4
Opcode Fuzzy Hash: 525d827b6180b2efaf2cb37344d015af513f467d5d003c052d4103516c540655
Instruction Fuzzy Hash: 48716C31A10B1AAFDB20DFA8CE89AAFBBF5FF48704F104518E542A25A5D774E950CF50

Function 0021FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0021FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0021FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0021FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0021FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0021FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0021FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0021FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0021FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0021FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0021FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0021FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0021FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0021FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0021FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0021FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0021FECC
GetCursorInfo.USER32(?), ref: 0021FEDC
GetLastError.KERNEL32 ref: 0021FF1E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 01853458181709a8e546fec13c598d55e4f885b4a1600cdda1def4a982c644e7
Instruction ID: e803d3a4a3f796817965ff9df5352fbf8cb7993e5d427fb8bcb032e73707ef35
Opcode Fuzzy Hash: 01853458181709a8e546fec13c598d55e4f885b4a1600cdda1def4a982c644e7
Instruction Fuzzy Hash: C74161B0D0831A6ADB109FBA8C8985EBFE8FF04354B50452AE11DE7681DB78E941CF90

Function 002030F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0020318D
_wcslen.LIBCMT ref: 002031F8

Strings

CLASSNN, xrefs: 002031F3, 00203204
REGEXPCLASS, xrefs: 00203255, 00203266
NAME, xrefs: 00203335, 00203346
[&, xrefs: 0020339A
TEXT, xrefs: 0020347C
INSTANCE, xrefs: 00203453
CLASS, xrefs: 00203188, 002031A5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[&
API String ID: 176396367-842257027
Opcode ID: 469e491f48b3a32bb5e8adb14302c11307fb222810c1eedcd0981ab101bfca5d
Instruction ID: 1a11fb31dee529d1532412fa3f71836de57279234b9874494cfe83f02dc32275
Opcode Fuzzy Hash: 469e491f48b3a32bb5e8adb14302c11307fb222810c1eedcd0981ab101bfca5d
Instruction Fuzzy Hash: 86E1E632A207269FCB14DF64C8917EDFBB8BF58710F548119E456E7282DB30AEA5C790

Function 001C00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 001C00C6

Part of subcall function 001C00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0027070C,00000FA0,ED0CB133,?,?,?,?,001E23B3,000000FF), ref: 001C011C
Part of subcall function 001C00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001E23B3,000000FF), ref: 001C0127
Part of subcall function 001C00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001E23B3,000000FF), ref: 001C0138
Part of subcall function 001C00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001C014E
Part of subcall function 001C00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001C015C
Part of subcall function 001C00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001C016A
Part of subcall function 001C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001C0195
Part of subcall function 001C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001C01A0

___scrt_fastfail.LIBCMT ref: 001C00E7

Part of subcall function 001C00A3: __onexit.LIBCMT ref: 001C00A9

Strings

InitializeConditionVariable, xrefs: 001C0148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 001C0122
SleepConditionVariableCS, xrefs: 001C0154
kernel32.dll, xrefs: 001C0133
WakeAllConditionVariable, xrefs: 001C0162

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: d98e97ec5b2879f21364948bf108c2cb04b36454cf8d19c3d5027a3bec88db88
Instruction ID: 45bdbb306d768becde95da70e8c7d11738690ea8e477d6af3f1c6135ce70c139
Opcode Fuzzy Hash: d98e97ec5b2879f21364948bf108c2cb04b36454cf8d19c3d5027a3bec88db88
Instruction Fuzzy Hash: 8821F672A44710EBE7166BA4BD4EF6AB3E4EB2DB51F15012DF845E2291DBB0DC008A90

Function 002144C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0023CC08), ref: 00214527
_wcslen.LIBCMT ref: 0021453B
_wcslen.LIBCMT ref: 00214599
_wcslen.LIBCMT ref: 002145F4
_wcslen.LIBCMT ref: 0021463F
_wcslen.LIBCMT ref: 002146A7

Part of subcall function 001BF9F2: _wcslen.LIBCMT ref: 001BF9FD

GetDriveTypeW.KERNEL32(?,00266BF0,00000061), ref: 00214743

Strings

cdrom, xrefs: 0021458F, 00214594
unknown, xrefs: 00214708
ramdisk, xrefs: 002146F1
fixed, xrefs: 00214635, 0021463A
removable, xrefs: 002145EA, 002145EF
network, xrefs: 0021469D, 002146A2
all, xrefs: 00214531, 00214536

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: ff53e3c4bf003131dff04e049717617ca3e1ca127a73d303d22b96901db40b24
Instruction ID: 11269534fec1ed8c6235d82b14367bd63f4f279159b4e1b7855fe6b51188c9fb
Opcode Fuzzy Hash: ff53e3c4bf003131dff04e049717617ca3e1ca127a73d303d22b96901db40b24
Instruction Fuzzy Hash: 1EB112716283029FC710EF28C890AAAF7E5BFB6724F50491DF49AD7291D730D895CB92

Function 0023911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

DragQueryPoint.SHELL32(?,?), ref: 00239147

Part of subcall function 00237674: ClientToScreen.USER32(?,?), ref: 0023769A
Part of subcall function 00237674: GetWindowRect.USER32(?,?), ref: 00237710
Part of subcall function 00237674: PtInRect.USER32(?,?,00238B89), ref: 00237720

SendMessageW.USER32(?,000000B0,?,?), ref: 002391B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 002391BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 002391DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00239225
SendMessageW.USER32(?,000000B0,?,?), ref: 0023923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00239255
SendMessageW.USER32(?,000000B1,?,?), ref: 00239277
DragFinish.SHELL32(?), ref: 0023927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00239371

Strings

@GUI_DROPID, xrefs: 0023929E
p#', xrefs: 002392BB
@GUI_DRAGID, xrefs: 002392E9
@GUI_DRAGFILE, xrefs: 00239320

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#'
API String ID: 221274066-3577977142
Opcode ID: 1ca9b00b5f79abbf6b0aad739cd0e5854b7312d4eb0ca62ab53fc7fa26a3c0f0
Instruction ID: 2a48c89f3f13c3284b4ddf53988a47f5778315a153623d8465d94d4237ca890f
Opcode Fuzzy Hash: 1ca9b00b5f79abbf6b0aad739cd0e5854b7312d4eb0ca62ab53fc7fa26a3c0f0
Instruction Fuzzy Hash: 97618B71108301AFC705EF64DC89DAFBBF8EF9A750F10091EF595922A0DB709A99CB52

Function 001A326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00271990), ref: 001E2F8D
GetMenuItemCount.USER32(00271990), ref: 001E303D
GetCursorPos.USER32(?), ref: 001E3081
SetForegroundWindow.USER32(00000000), ref: 001E308A
TrackPopupMenuEx.USER32(00271990,00000000,?,00000000,00000000,00000000), ref: 001E309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 001E30A9

Strings

0, xrefs: 001A327D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 99026ce25763aa264ec2f6cefa3401b74d61e361617613236f5e1b2723f3db7d
Instruction ID: 2a93fdde84f804f9c7278927b783ae3447c302c1ff425e8983cf85de8698efd3
Opcode Fuzzy Hash: 99026ce25763aa264ec2f6cefa3401b74d61e361617613236f5e1b2723f3db7d
Instruction Fuzzy Hash: 17713571640655BEFB258F69DC59FAEBF68FF05324F204206F524AA1E0C7B1AD60CB90

Function 00236CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00236DEB

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00236E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00236E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00236E94
DestroyWindow.USER32(?), ref: 00236EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,001A0000,00000000), ref: 00236EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00236EFD
GetDesktopWindow.USER32 ref: 00236F16
GetWindowRect.USER32(00000000), ref: 00236F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00236F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00236F4D

Part of subcall function 001B9944: GetWindowLongW.USER32(?,000000EB), ref: 001B9952

Strings

0, xrefs: 00236D98
tooltips_class32, xrefs: 00236E58, 00236EDD

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 88af7822adeb90cc609ae506435abf516fa11f1bc95782569f67ae2f2c56fdad
Instruction ID: 9ba5f95db3a7112175784da77d9259453cdf6b686c0b8335be2f224883c7610e
Opcode Fuzzy Hash: 88af7822adeb90cc609ae506435abf516fa11f1bc95782569f67ae2f2c56fdad
Instruction Fuzzy Hash: 1B718CB4114241AFDB25CF18EC48F6ABBF9FB89304F14441DFA8997260C770A956CF21

Function 0021C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0021C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0021C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0021C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0021C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0021C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0021C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0021C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0021C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0021C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0021C5F0
InternetCloseHandle.WININET(00000000), ref: 0021C5FB

Strings

, xrefs: 0021C575

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 85d2bbe1243b992e193c8fd5f758c8ec0a5a77d180f99922cf406cd33016ad93
Instruction ID: 0d6beb8b6b9ca06f01d0b6432f31ef44282d8f92787e21e365f4d2fbc73a437e
Opcode Fuzzy Hash: 85d2bbe1243b992e193c8fd5f758c8ec0a5a77d180f99922cf406cd33016ad93
Instruction Fuzzy Hash: 83517DB5550205BFDB218F60DD48ABBBBFDFF18754F20441AF945E6210DB30E9949B60

Function 0023856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00238592
GetFileSize.KERNEL32(00000000,00000000), ref: 002385A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 002385AD
CloseHandle.KERNEL32(00000000), ref: 002385BA
GlobalLock.KERNEL32(00000000), ref: 002385C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 002385D7
GlobalUnlock.KERNEL32(00000000), ref: 002385E0
CloseHandle.KERNEL32(00000000), ref: 002385E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 002385F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0023FC38,?), ref: 00238611
GlobalFree.KERNEL32(00000000), ref: 00238621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00238641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00238671
DeleteObject.GDI32(00000000), ref: 00238699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 002386AF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 531d3fb15b5c32ce670d2d3bd7e37cfb92da177a9148ff0127adb9053c263d09
Instruction ID: 5ea0707384f1acb1206aa1d1f0bd36c37c289cb8e1c43c4038dcbfb592cc1339
Opcode Fuzzy Hash: 531d3fb15b5c32ce670d2d3bd7e37cfb92da177a9148ff0127adb9053c263d09
Instruction Fuzzy Hash: B441FAB5600205AFDB119FA5DC8DEAB7BBCEF89B11F108059F909EB260DB709911DF60

Function 002114BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00211502
VariantCopy.OLEAUT32(?,?), ref: 0021150B
VariantClear.OLEAUT32(?), ref: 00211517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 002115FB
VarR8FromDec.OLEAUT32(?,?), ref: 00211657
VariantInit.OLEAUT32(?), ref: 00211708
SysFreeString.OLEAUT32(?), ref: 0021178C
VariantClear.OLEAUT32(?), ref: 002117D8
VariantClear.OLEAUT32(?), ref: 002117E7
VariantInit.OLEAUT32(00000000), ref: 00211823

Strings

Default, xrefs: 002116AF
%4d%02d%02d%02d%02d%02d, xrefs: 00211625

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 79f7c76c0c8eb6ec376fa479a8f3610ee6e1fd264b2ba08775e508d779abf026
Instruction ID: 2a678ef03b18fdcc72a5caf074e9d2f57d444937ac7846c487f10d7b774d6be2
Opcode Fuzzy Hash: 79f7c76c0c8eb6ec376fa479a8f3610ee6e1fd264b2ba08775e508d779abf026
Instruction Fuzzy Hash: 57D10231620115EBDB109F64E884BFEB7F6BF65700F60805AE646AB280DB70DCB1DB52

Function 0022B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0022B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0022B80A
RegCloseKey.ADVAPI32(?), ref: 0022B87E
RegCloseKey.ADVAPI32(?), ref: 0022B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0022B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0022B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0022B922
FreeLibrary.KERNEL32(00000000), ref: 0022B983
RegCloseKey.ADVAPI32(00000000), ref: 0022B994

Strings

RegDeleteKeyExW, xrefs: 0022B8FE
advapi32.dll, xrefs: 0022B8ED

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 725ba9e972093c3640afd16f5efc55d0f7cdabbcfd89d773675842ccb794ba7b
Instruction ID: 9db573f5715f4d1b03e43098ff73dfae816c07e8be77e264c566802e1a795936
Opcode Fuzzy Hash: 725ba9e972093c3640afd16f5efc55d0f7cdabbcfd89d773675842ccb794ba7b
Instruction Fuzzy Hash: F2C1BD35218212AFD715DF54D494F2ABBE5FF85318F14845CF49A8B2A2CB71EC86CB82

Function 0022255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 002225D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 002225E8
CreateCompatibleDC.GDI32(?), ref: 002225F4
SelectObject.GDI32(00000000,?), ref: 00222601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0022266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 002226AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 002226D0
SelectObject.GDI32(?,?), ref: 002226D8
DeleteObject.GDI32(?), ref: 002226E1
DeleteDC.GDI32(?), ref: 002226E8
ReleaseDC.USER32(00000000,?), ref: 002226F3

Strings

(, xrefs: 0022268D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 2331969d130fb6e0b2d3df4eb288ef5297b2305a4f58bd7bd2ffa68a16051608
Instruction ID: 9f46de9d16a1764c84acd5c4810d9c57c5034ea5d977ec087af676a80194b56e
Opcode Fuzzy Hash: 2331969d130fb6e0b2d3df4eb288ef5297b2305a4f58bd7bd2ffa68a16051608
Instruction Fuzzy Hash: BD611376D10219EFCF14CFE4E888AAEBBB9FF48310F208429E955A7250D371A951CF60

Function 001DDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 001DDAA1

Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD659
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD66B
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD67D
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD68F
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6A1
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6B3
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6C5
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6D7
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6E9
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6FB
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD70D
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD71F
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD731

_free.LIBCMT ref: 001DDA96

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DDAB8
_free.LIBCMT ref: 001DDACD
_free.LIBCMT ref: 001DDAD8
_free.LIBCMT ref: 001DDAFA
_free.LIBCMT ref: 001DDB0D
_free.LIBCMT ref: 001DDB1B
_free.LIBCMT ref: 001DDB26
_free.LIBCMT ref: 001DDB5E
_free.LIBCMT ref: 001DDB65
_free.LIBCMT ref: 001DDB82
_free.LIBCMT ref: 001DDB9A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 27f66aa4772b55e71ddbd3a41c828195c6f7593c6a07653b9533621dc09aaed2
Instruction ID: 9b7933bdaeb997513925d9ca33b0d3709cb9355373d98399e0d47684c830b447
Opcode Fuzzy Hash: 27f66aa4772b55e71ddbd3a41c828195c6f7593c6a07653b9533621dc09aaed2
Instruction Fuzzy Hash: DA315C316047059FEB25AA39E845B6A77E9FF21318F15841BE459D7391DF31EC80DB20

Function 0020365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0020369C
_wcslen.LIBCMT ref: 002036A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00203797
GetClassNameW.USER32(?,?,00000400), ref: 0020380C
GetDlgCtrlID.USER32(?), ref: 0020385D
GetWindowRect.USER32(?,?), ref: 00203882
GetParent.USER32(?), ref: 002038A0
ScreenToClient.USER32(00000000), ref: 002038A7
GetClassNameW.USER32(?,?,00000100), ref: 00203921
GetWindowTextW.USER32(?,?,00000400), ref: 0020395D

Strings

%s%u, xrefs: 00203734

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: d657221645ed94c7fa1fbb86e221779d8629663bfb88ed3846320e17c1a58076
Instruction ID: b522ad6ce437b3103ea85233496350b3ae0a3f226a7d822ed7b8d1d98d542490
Opcode Fuzzy Hash: d657221645ed94c7fa1fbb86e221779d8629663bfb88ed3846320e17c1a58076
Instruction Fuzzy Hash: 5591BB7121470BAFD719DF24C885BAAB7ACFF44310F108629F999D2192DB30EA65CB91

Function 00204954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00204994
GetWindowTextW.USER32(?,?,00000400), ref: 002049DA
_wcslen.LIBCMT ref: 002049EB
CharUpperBuffW.USER32(?,00000000), ref: 002049F7
_wcsstr.LIBVCRUNTIME ref: 00204A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00204A64
GetWindowTextW.USER32(?,?,00000400), ref: 00204A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00204AE6
GetClassNameW.USER32(?,?,00000400), ref: 00204B20
GetWindowRect.USER32(?,?), ref: 00204B8B

Strings

ThumbnailClass, xrefs: 00204A6F, 00204AF1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 857d084b62c9b3a0b58e6d794ea1c92dabaa227b5eb5dd253fa3f08eebd96b07
Instruction ID: 5aa9c43c2dc7af5669e5470424cfdaae85bfe53cba872c5a5b65db9bcfbf3842
Opcode Fuzzy Hash: 857d084b62c9b3a0b58e6d794ea1c92dabaa227b5eb5dd253fa3f08eebd96b07
Instruction Fuzzy Hash: 9991BCB11183069BDB04EE14C985FAA77E8FF84318F04846AFE859A0D6DB30ED55CBA1

Function 0020BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00271990,000000FF,00000000,00000030), ref: 0020BFAC
SetMenuItemInfoW.USER32(00271990,00000004,00000000,00000030), ref: 0020BFE1
Sleep.KERNEL32(000001F4), ref: 0020BFF3
GetMenuItemCount.USER32(?), ref: 0020C039
GetMenuItemID.USER32(?,00000000), ref: 0020C056
GetMenuItemID.USER32(?,-00000001), ref: 0020C082
GetMenuItemID.USER32(?,?), ref: 0020C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0020C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0020C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0020C145

Strings

0, xrefs: 0020BF3D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 4e70e109a40d08fca98377baf056afbeb87924bf5157824fff056e9027f53838
Instruction ID: 2693b3f1e6c05d620c0adcf9aac4710e13106cb2591416c1a20ea4cca33c7243
Opcode Fuzzy Hash: 4e70e109a40d08fca98377baf056afbeb87924bf5157824fff056e9027f53838
Instruction Fuzzy Hash: D2618EB092034AAFDF11CF64DC88AAEBBB9EB05344F200255F815A32D2D771AD65CB60

Function 0022CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0022CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0022CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0022CD48

Part of subcall function 0022CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0022CCAA
Part of subcall function 0022CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0022CCBD
Part of subcall function 0022CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0022CCCF
Part of subcall function 0022CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0022CD05
Part of subcall function 0022CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0022CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0022CCF3

Strings

RegDeleteKeyExW, xrefs: 0022CCC9
advapi32.dll, xrefs: 0022CCB8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: e026b12b9aa866dfa2194b1c27c9eda1c42293d8d7dda7d220eadad1c1f57753
Instruction ID: c2733779d86df0ee9fd1a498be7cfcfb1083e50670b4d800a4d2ef1d3f5004c0
Opcode Fuzzy Hash: e026b12b9aa866dfa2194b1c27c9eda1c42293d8d7dda7d220eadad1c1f57753
Instruction Fuzzy Hash: 2B318075911129BBD7248FA1EC8CEFFBB7CEF05750F200165A905E3240DA749E45ABA0

Function 00213D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00213D40
_wcslen.LIBCMT ref: 00213D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00213D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00213DBE
RemoveDirectoryW.KERNEL32(?), ref: 00213DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00213E55
CloseHandle.KERNEL32(00000000), ref: 00213E60
CloseHandle.KERNEL32(00000000), ref: 00213E6B

Strings

\, xrefs: 00213D77
\??\%s, xrefs: 00213D5B
:, xrefs: 00213D82

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 46178155362ec1b5fb65c8da36e8b1bb6094c0e1ce996025a425cf1d57424fef
Instruction ID: d78d826f578f38b1ce30ea3f14280d93d4ab33caf22dacad25de8f37caf96fea
Opcode Fuzzy Hash: 46178155362ec1b5fb65c8da36e8b1bb6094c0e1ce996025a425cf1d57424fef
Instruction Fuzzy Hash: 8431927291020AABDB20DFA0EC49FEF37BDEF99700F1040A5F505E6090E77497948B64

Function 0020E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0020E6B4

Part of subcall function 001BE551: timeGetTime.WINMM(?,?,0020E6D4), ref: 001BE555

Sleep.KERNEL32(0000000A), ref: 0020E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0020E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0020E727
SetActiveWindow.USER32 ref: 0020E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0020E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0020E773
Sleep.KERNEL32(000000FA), ref: 0020E77E
IsWindow.USER32 ref: 0020E78A
EndDialog.USER32(00000000), ref: 0020E79B

Strings

BUTTON, xrefs: 0020E719

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b42710ac632ef168a3deadfceb8de18ec262172130e7366ea5c1f1a7e92f736e
Instruction ID: ebaf77e1e0fe9f8ac1b397678fae5e7d761211f029ae4611e31e068dd42b8868
Opcode Fuzzy Hash: b42710ac632ef168a3deadfceb8de18ec262172130e7366ea5c1f1a7e92f736e
Instruction Fuzzy Hash: EA21A1B0210301EFEF006F20FC8DA257B6DFB94348F250825F90AA11F2DB71ACA49B24

Function 0020E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0020EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0020EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0020EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0020EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0020EAA7

Strings

status PlayMe mode, xrefs: 0020EA58
play PlayMe wait, xrefs: 0020EA91
close PlayMe, xrefs: 0020EA6E, 0020EA9B
alias PlayMe, xrefs: 0020EA36
play PlayMe, xrefs: 0020EAA2
open , xrefs: 0020EA0C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 8b0c05b11ca4fab2eb4dbcd73c587b3f71c3f3999aa42cf3c12ee5dbecb91602
Instruction ID: e73da22dd73c6e229dc29e1d98fb99fb53072bbb9d988797691a6acbf600bdba
Opcode Fuzzy Hash: 8b0c05b11ca4fab2eb4dbcd73c587b3f71c3f3999aa42cf3c12ee5dbecb91602
Instruction Fuzzy Hash: DB117735A6125979DB10A762DC4EEFF6A7CEFD7B40F4408297811A20D1DFB00995C5B0

Function 00205CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00205CE2
GetWindowRect.USER32(00000000,?), ref: 00205CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00205D59
GetDlgItem.USER32(?,00000002), ref: 00205D69
GetWindowRect.USER32(00000000,?), ref: 00205D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00205DCF
GetDlgItem.USER32(?,000003E9), ref: 00205DDD
GetWindowRect.USER32(00000000,?), ref: 00205DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00205E31
GetDlgItem.USER32(?,000003EA), ref: 00205E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00205E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00205E67

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 21518b529318768f273c1e3249b1c8ca8794364c96742332daf93abe2064de48
Instruction ID: 4747233ffd2bcd64c51ab538e022346cb533f1dfa69d1a619dcd12a6903f53e0
Opcode Fuzzy Hash: 21518b529318768f273c1e3249b1c8ca8794364c96742332daf93abe2064de48
Instruction Fuzzy Hash: B1512EB0A10715AFDF18CF68DD89AAEBBB9FB48310F208129F915E6291D7709E10CF50

Function 001B8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 001B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001B8BE8,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001B8FC5

DestroyWindow.USER32(?), ref: 001B8C81
KillTimer.USER32(00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001B8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 001F6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001F69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001F69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,001B8BBA,00000000), ref: 001F69D4
DeleteObject.GDI32(00000000), ref: 001F69E6

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e1b7f6616502b2bf11dd31fc3f962835e5d637056c36a82bc8eb81a5ddd415ef
Instruction ID: 9b68fb5e67e3f2929e2e7969b7dbc126ee73720458baaac7be5bc44a2df12062
Opcode Fuzzy Hash: e1b7f6616502b2bf11dd31fc3f962835e5d637056c36a82bc8eb81a5ddd415ef
Instruction Fuzzy Hash: E061B971102605DFCB299F28E948BA5BBF5FF40716F244518E246AB960CB71A8A1DFA0

Function 001B9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 001B9944: GetWindowLongW.USER32(?,000000EB), ref: 001B9952

GetSysColor.USER32(0000000F), ref: 001B9862

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a2cc7f5a2d4b2dafae3bc5f274570b0b8d56126bc282513e14675436440e7670
Instruction ID: 010c234e673c26b5c4894d763b821ecd63224ab33ac0fc0253c3b5db3d90c773
Opcode Fuzzy Hash: a2cc7f5a2d4b2dafae3bc5f274570b0b8d56126bc282513e14675436440e7670
Instruction Fuzzy Hash: 15418E31104648AFDB215F38AC88BF93BB5AB06331F244659FBA69B2E1D7319C43DB10

Function 002096E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,001EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00209717
LoadStringW.USER32(00000000,?,001EF7F8,00000001), ref: 00209720

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,001EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00209742
LoadStringW.USER32(00000000,?,001EF7F8,00000001), ref: 00209745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00209866

Strings

Line %d (File "%s"):, xrefs: 0020978F
%s (%d) : ==> %s: %s %s, xrefs: 0020984A
Error: , xrefs: 0020981D
Line %d:, xrefs: 002097A0
^ ERROR, xrefs: 002097FB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: a792f80964f70c14e68c8807cdef6725bb7d03f471a791d0fb7f29b82193b734
Instruction ID: 53550bbf7f63a0b43b64bb47f8069067723d3a60f45fa852e65fbf94518d63b5
Opcode Fuzzy Hash: a792f80964f70c14e68c8807cdef6725bb7d03f471a791d0fb7f29b82193b734
Instruction Fuzzy Hash: E5415172800219AACF05EBE1DD46EEEB778EF66340F504065F50672092EF356F99CB61

Function 002006DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 002007A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 002007BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 002007DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00200804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0020082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00200837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0020083C

Strings

SOFTWARE\Classes\, xrefs: 0020070E
\CLSID, xrefs: 00200724
\IPC$, xrefs: 00200784

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 853a44564232bcb4a27f7c67cb33e78e1b0c1f505a878e7240680f6ff263172a
Instruction ID: 66f1eb9bc7e23b6d211b6e1d107033aca3d8fdefbbedfc9853ed125033ee17b9
Opcode Fuzzy Hash: 853a44564232bcb4a27f7c67cb33e78e1b0c1f505a878e7240680f6ff263172a
Instruction Fuzzy Hash: 39411476C20229ABDF15EFA4DC85DEEB778BF14350F544129E901B31A1EB349E54CBA0

Function 00223C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00223C5C
CoInitialize.OLE32(00000000), ref: 00223C8A
CoUninitialize.OLE32 ref: 00223C94
_wcslen.LIBCMT ref: 00223D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00223DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00223ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00223F0E
CoGetObject.OLE32(?,00000000,0023FB98,?), ref: 00223F2D
SetErrorMode.KERNEL32(00000000), ref: 00223F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00223FC4
VariantClear.OLEAUT32(?), ref: 00223FD8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 23c9f33afd2ec78ea0f252f5e761256aacae61ac5562ec069c291b67bfd48527
Instruction ID: 8e1992bbf71559c2554b525c88dbd0c94e3f3dedde40738530fb035e37d3f774
Opcode Fuzzy Hash: 23c9f33afd2ec78ea0f252f5e761256aacae61ac5562ec069c291b67bfd48527
Instruction Fuzzy Hash: B0C17671618311AFD700DFA8E88492BB7E9FF89748F10491DF98A9B251DB34EE05CB52

Function 00217A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00217AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00217B8F
SHGetDesktopFolder.SHELL32(?), ref: 00217BA3
CoCreateInstance.OLE32(0023FD08,00000000,00000001,00266E6C,?), ref: 00217BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00217C74
CoTaskMemFree.OLE32(?,?), ref: 00217CCC
SHBrowseForFolderW.SHELL32(?), ref: 00217D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00217D7A
CoTaskMemFree.OLE32(00000000), ref: 00217D81
CoTaskMemFree.OLE32(00000000), ref: 00217DD6
CoUninitialize.OLE32 ref: 00217DDC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: d88dea38b00b03aa6bdf7249909e1eb803b07475ce852574751089bdbccf7eed
Instruction ID: 39a5684903a05a71ec41c29e5f9f2145a492bbada19d950458651c4d4b83824d
Opcode Fuzzy Hash: d88dea38b00b03aa6bdf7249909e1eb803b07475ce852574751089bdbccf7eed
Instruction Fuzzy Hash: F2C13C75A04109AFCB14DF64D888DAEBBF9FF59304B148499F916EB261D730EE81CB90

Function 0023541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00235504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00235515
CharNextW.USER32(00000158), ref: 00235544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00235585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0023559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002355AC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 07d2e2724096d216253be37fa180b3580c39a5e30b90af33345dc8db4d64fdb2
Instruction ID: 67325e325ffca5af01a36070438242899c45b10c17f8bc3cc80cd473ed3a2f46
Opcode Fuzzy Hash: 07d2e2724096d216253be37fa180b3580c39a5e30b90af33345dc8db4d64fdb2
Instruction Fuzzy Hash: DA61B0B0920629EBDF14CF54DC85AFE7BB9FF09320F504045F629A6290D7749AA1DFA0

Function 001FFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 001FFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 001FFB08
VariantInit.OLEAUT32(?), ref: 001FFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 001FFB3A
VariantCopy.OLEAUT32(?,?), ref: 001FFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 001FFBA1
VariantClear.OLEAUT32(?), ref: 001FFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 001FFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001FFBCC
VariantClear.OLEAUT32(?), ref: 001FFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001FFBE9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: cfcd382d8196abcbdc2caa6a230c7cc6dc1938de2c588502792bac86444cde24
Instruction ID: 0098a9bf6e0a2de340bec2d6c2849a13b09df482de9f0a0085649d823a06e800
Opcode Fuzzy Hash: cfcd382d8196abcbdc2caa6a230c7cc6dc1938de2c588502792bac86444cde24
Instruction Fuzzy Hash: 6D414035A0021D9FCB04DF68D8589FEBBB9FF58354F108069EA56A7261CB70E946CF90

Function 00209C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00209CA1
GetAsyncKeyState.USER32(000000A0), ref: 00209D22
GetKeyState.USER32(000000A0), ref: 00209D3D
GetAsyncKeyState.USER32(000000A1), ref: 00209D57
GetKeyState.USER32(000000A1), ref: 00209D6C
GetAsyncKeyState.USER32(00000011), ref: 00209D84
GetKeyState.USER32(00000011), ref: 00209D96
GetAsyncKeyState.USER32(00000012), ref: 00209DAE
GetKeyState.USER32(00000012), ref: 00209DC0
GetAsyncKeyState.USER32(0000005B), ref: 00209DD8
GetKeyState.USER32(0000005B), ref: 00209DEA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 26e515ab461bbc536b250d807b520f940385e1d2c1631a074cdbdc22ae29ced8
Instruction ID: ea322b34136f1474b4cc4482330bc70e04947cdd73931c6399686b7da2afbb96
Opcode Fuzzy Hash: 26e515ab461bbc536b250d807b520f940385e1d2c1631a074cdbdc22ae29ced8
Instruction Fuzzy Hash: 0D41E6309647CB69FF309F64C8043B5BEA0AB15304F44805ACAC7565C3DBA49DE8C792

Function 0022055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002205BC
inet_addr.WSOCK32(?), ref: 0022061C
gethostbyname.WSOCK32(?), ref: 00220628
IcmpCreateFile.IPHLPAPI ref: 00220636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 002206C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 002206E5
IcmpCloseHandle.IPHLPAPI(?), ref: 002207B9
WSACleanup.WSOCK32 ref: 002207BF

Strings

Ping, xrefs: 00220676

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c8a65b69c959f7dcc68c7cd6f7a0a26d95aad44b1289ec41cd754646b6db6709
Instruction ID: aeb6b11bc61351ce7946f29bbf02b0eed60c28739954aa8b5ddadf2db0b8f046
Opcode Fuzzy Hash: c8a65b69c959f7dcc68c7cd6f7a0a26d95aad44b1289ec41cd754646b6db6709
Instruction Fuzzy Hash: A191AD35618212AFD320CF55E8C8F1ABBE4AF48318F1485A9F4699B6A3C770ED51CF81

Function 00228CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00228CF3

Part of subcall function 00208E54: _wcslen.LIBCMT ref: 00208E77

_wcslen.LIBCMT ref: 00228D4E
_wcslen.LIBCMT ref: 00228D9C
_wcslen.LIBCMT ref: 00228DDC
_wcslen.LIBCMT ref: 00228E6E

Strings

cdecl, xrefs: 00228D48, 00228D4D
stdcall, xrefs: 00228DD6, 00228DDB
winapi, xrefs: 00228D96, 00228D9B
none, xrefs: 00228E65, 00228E6A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: c29aded0ec029317e90d0248762f1b9b69875a4da4f7011a9afb25f9d3eb02ad
Instruction ID: 8c69faab3642a8f8079418b200440ac652cf74b5fa7328c48630677387d09f64
Opcode Fuzzy Hash: c29aded0ec029317e90d0248762f1b9b69875a4da4f7011a9afb25f9d3eb02ad
Instruction Fuzzy Hash: 4B51D331A25127ABCF24DFA8D8409BEB3A5BF75324B614229F426E72C4DB30DD50C790

Function 0022372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00223774
CoUninitialize.OLE32 ref: 0022377F
CoCreateInstance.OLE32(?,00000000,00000017,0023FB78,?), ref: 002237D9
IIDFromString.OLE32(?,?), ref: 0022384C
VariantInit.OLEAUT32(?), ref: 002238E4
VariantClear.OLEAUT32(?), ref: 00223936

Strings

Invalid parameter, xrefs: 00223865
Failed to create object, xrefs: 002237E4, 0022389A
NULL Pointer assignment, xrefs: 0022381E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 1060a3333b4a8df7efd70b1dfdb0510ff4f6853eb266d8a9febfeb56c36c3374
Instruction ID: 40802867a061e6f461da338cd1345ccf8314da7e94dddcc0dfcd1658f77c6dc5
Opcode Fuzzy Hash: 1060a3333b4a8df7efd70b1dfdb0510ff4f6853eb266d8a9febfeb56c36c3374
Instruction Fuzzy Hash: E661E370628321AFD711DF94E888F5AB7E8EF49714F10081DF9859B291C774EE98CB92

Function 00213388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 002133CF

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 002133F0

Strings

Line %d (File "%s"):, xrefs: 00213443, 0021345C
^ ERROR , xrefs: 0021349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00213504
Incorrect parameters to object property !, xrefs: 002134AB
Error: , xrefs: 002134D1
"%s" (%d) : ==> %s:, xrefs: 00213522

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 8339c9b4bf78fb0cab294ddf3bc47833761553730ca6973783a0e5311c70f412
Instruction ID: 1eb97ce3554528edba0228f60d789e79d7127c6bcf4b97488baa5b44b2031568
Opcode Fuzzy Hash: 8339c9b4bf78fb0cab294ddf3bc47833761553730ca6973783a0e5311c70f412
Instruction Fuzzy Hash: 47518071910219BADF15EBE0DD46EEEB7B9AF25740F204065F40572092EB352FA8DF60

Function 0020B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0020B5FC
_wcslen.LIBCMT ref: 0020B608
_wcslen.LIBCMT ref: 0020B64D
_wcslen.LIBCMT ref: 0020B68C
_wcslen.LIBCMT ref: 0020B6C7

Strings

REMOVE, xrefs: 0020B602, 0020B607
EXISTS, xrefs: 0020B686, 0020B68B
APPEND, xrefs: 0020B6C1, 0020B6C6
KEYS, xrefs: 0020B647, 0020B64C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 7768f8b1918f96bebc55b8731c5584e1b6ebd6336e25181991480dd1e8a5d722
Instruction ID: 5bdf850ee564676c5040657964aa65b3494cb0042e5e3cc727a8fdb3c2aaebd5
Opcode Fuzzy Hash: 7768f8b1918f96bebc55b8731c5584e1b6ebd6336e25181991480dd1e8a5d722
Instruction Fuzzy Hash: 5541C932A202279BCB315F7DC8905BEB7A9AF71754B244229E421D72C6E732CD91C790

Function 00215393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002153A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00215416
GetLastError.KERNEL32 ref: 00215420
SetErrorMode.KERNEL32(00000000,READY), ref: 002154A7

Strings

NOTREADY, xrefs: 0021544B
READONLY, xrefs: 00215452
READY, xrefs: 00215460, 00215468
INVALID, xrefs: 00215459
UNKNOWN, xrefs: 00215444

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 31acdb3faab49a794bc0a40dad1d7f44c90069c7fecab730ab54430194b6c071
Instruction ID: 6da53141db36360d3be59f556ba8be136c18b240a549ab878b866251f9ed184d
Opcode Fuzzy Hash: 31acdb3faab49a794bc0a40dad1d7f44c90069c7fecab730ab54430194b6c071
Instruction Fuzzy Hash: FB319D39A20615DFC710DF68D488AEABBF4EBA5305F1480A5E405DB292DB71EDD2CB90

Function 00233C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00233C79
SetMenu.USER32(?,00000000), ref: 00233C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00233D10
IsMenu.USER32(?), ref: 00233D24
CreatePopupMenu.USER32 ref: 00233D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00233D5B
DrawMenuBar.USER32 ref: 00233D63

Strings

F, xrefs: 00233D4E
0, xrefs: 00233C54

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: ed4f165be71f00adf6c6daa14c6ec8ae854bf4c69a25c9c7798f5423ffa46fa1
Instruction ID: ca266ebe776366c852959679e888d0658356ad2b01878fb0e1e2883562dec24b
Opcode Fuzzy Hash: ed4f165be71f00adf6c6daa14c6ec8ae854bf4c69a25c9c7798f5423ffa46fa1
Instruction Fuzzy Hash: 46413DB5A1120AEFDB14DF64E848A9A7BB5FF49350F140029F946A7360D770AA20CF94

Function 00201EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00201F64
GetDlgCtrlID.USER32 ref: 00201F6F
GetParent.USER32 ref: 00201F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00201F8E
GetDlgCtrlID.USER32(?), ref: 00201F97
GetParent.USER32(?), ref: 00201FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00201FAE

Strings

ListBox, xrefs: 00201F21
ComboBox, xrefs: 00201EEC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: b7d070c430daf8688263b32aeec808e035b34d3bea6db26ed53f47903eeceb9c
Instruction ID: 03e04a0f8bb3546cf52ab48a480ac38b6b99b89a448a5a078a74288a0ab3e274
Opcode Fuzzy Hash: b7d070c430daf8688263b32aeec808e035b34d3bea6db26ed53f47903eeceb9c
Instruction Fuzzy Hash: 3621B074910314BBCF09AFA0DC899EEBBB8EF56350F104115F961A72D2CB7459649F60

Function 00233A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00233A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00233AA0
GetWindowLongW.USER32(?,000000F0), ref: 00233AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00233AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00233B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00233BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00233BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00233BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00233BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00233C13

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a8930249fcce63369a034dc10b1ee7366f0c3174d876890b2d90fd3d3c233635
Instruction ID: c8d2d4a9447825e5b2e17adce2af685f32e44c03e8059beb437b644c644df371
Opcode Fuzzy Hash: a8930249fcce63369a034dc10b1ee7366f0c3174d876890b2d90fd3d3c233635
Instruction Fuzzy Hash: 44617BB5900248AFDB10DF68CC81EEEB7B8EF09704F10409AFA15E72A1C770AE56DB50

Function 0020B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B165
GetWindowThreadProcessId.USER32(00000000), ref: 0020B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0020B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B21D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 0392dd604735adb02908ac6bf01448bbe643ed5284b75aedc91b840fef9639b5
Instruction ID: 5a54ab43ea057b8b098c767a9c23f977ee1d7745996adecb6a603782a9bfad3c
Opcode Fuzzy Hash: 0392dd604735adb02908ac6bf01448bbe643ed5284b75aedc91b840fef9639b5
Instruction Fuzzy Hash: D231CC71520305BFDB22DF24EC4DB6DBBADBB60311F204414FA08E62D1D7B49A909F60

Function 001D2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001D2C94

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001D2CA0
_free.LIBCMT ref: 001D2CAB
_free.LIBCMT ref: 001D2CB6
_free.LIBCMT ref: 001D2CC1
_free.LIBCMT ref: 001D2CCC
_free.LIBCMT ref: 001D2CD7
_free.LIBCMT ref: 001D2CE2
_free.LIBCMT ref: 001D2CED
_free.LIBCMT ref: 001D2CFB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5954d9d00d97fec5ee8f0c01de52cafb9086a42d6b4e53e83ac9373ad0d68d25
Instruction ID: 7cd0863c511c7773438c14c6a2f819d128a68c472145d47bdf02ecc203446142
Opcode Fuzzy Hash: 5954d9d00d97fec5ee8f0c01de52cafb9086a42d6b4e53e83ac9373ad0d68d25
Instruction Fuzzy Hash: C811A476110118AFCB06EF54D892CDD3BA5FF25354F4144A6FA589F322DB31EE50AB90

Function 001A1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 001A1459
OleUninitialize.OLE32(?,00000000), ref: 001A14F8
UnregisterHotKey.USER32(?), ref: 001A16DD
DestroyWindow.USER32(?), ref: 001E24B9
FreeLibrary.KERNEL32(?), ref: 001E251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 001E254B

Strings

close all, xrefs: 001A1454

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: eeebad7c691013fc39a5d176180f86dbdbac82b101068c6403d875aaf1dd2e4f
Instruction ID: ad1b4d45796442f5319162b5f0b7b9ccef185e4daa65e905f6376d746923b49a
Opcode Fuzzy Hash: eeebad7c691013fc39a5d176180f86dbdbac82b101068c6403d875aaf1dd2e4f
Instruction Fuzzy Hash: 27D1A235701212DFCB19EF15C9A9B69F7A5BF16700F2542ADE84AAB251CB30ED22CF50

Function 00217DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00217FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00217FC1
GetFileAttributesW.KERNEL32(?), ref: 00217FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00218005
SetCurrentDirectoryW.KERNEL32(?), ref: 00218017
SetCurrentDirectoryW.KERNEL32(?), ref: 00218060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 002180B0

Strings

*.*, xrefs: 00218066

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: a0c99450873f3763ff0c26d9f37a1db422d5c9cd6a2cf20545615d11878a993b
Instruction ID: 6438cbe02050c65fcc6cc8ec7628ccb470219064e8d0aea60426d445592845fd
Opcode Fuzzy Hash: a0c99450873f3763ff0c26d9f37a1db422d5c9cd6a2cf20545615d11878a993b
Instruction Fuzzy Hash: 9F81A1725282469BCB20EF14C884AEAB3E8BFE9310F14485EF885D7250DB75DD958B92

Function 001A5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 001A5C7A

Part of subcall function 001A5D0A: GetClientRect.USER32(?,?), ref: 001A5D30
Part of subcall function 001A5D0A: GetWindowRect.USER32(?,?), ref: 001A5D71
Part of subcall function 001A5D0A: ScreenToClient.USER32(?,?), ref: 001A5D99

GetDC.USER32 ref: 001E46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 001E4708
SelectObject.GDI32(00000000,00000000), ref: 001E4716
SelectObject.GDI32(00000000,00000000), ref: 001E472B
ReleaseDC.USER32(?,00000000), ref: 001E4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001E47C4

Strings

U, xrefs: 001E4693

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 14a0b83fce4f6539afe46b9496831795b21c527c6119f3af937cc36d3bd47fe2
Instruction ID: 940b028b617836da7b3126987491345419526dc50e437b6a7d0afb30d10cbac0
Opcode Fuzzy Hash: 14a0b83fce4f6539afe46b9496831795b21c527c6119f3af937cc36d3bd47fe2
Instruction Fuzzy Hash: 5471F234800A45DFCF25CF65C988ABE7BB6FF4A360F184269ED565A16AC3318C81DF90

Function 0021359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002135E4

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

LoadStringW.USER32(00272390,?,00000FFF,?), ref: 0021360A

Strings

Line %d (File "%s"):, xrefs: 0021366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00213724
Error: , xrefs: 002136EF
"%s" (%d) : ==> %s:, xrefs: 00213742
^ ERROR, xrefs: 002136C9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 3083d72ae142973b93042a1cc2f01cab6b8146bf5f00f6099cf1d04ffd48fab4
Instruction ID: 61694e2069342fa84dd2bd054897af06b9a471e62c32aafde0033ff93c363eed
Opcode Fuzzy Hash: 3083d72ae142973b93042a1cc2f01cab6b8146bf5f00f6099cf1d04ffd48fab4
Instruction Fuzzy Hash: 31519F7181021ABADF15EBA0DC46EEEBB79EF25340F144165F105721A2EB301BE9DFA0

Function 0021C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0021C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0021C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0021C2CA
GetLastError.KERNEL32 ref: 0021C322
SetEvent.KERNEL32(?), ref: 0021C336
InternetCloseHandle.WININET(00000000), ref: 0021C341

Strings

, xrefs: 0021C2BB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: bf290e1a8b17e8bd775b0551079ed378151461e6e28a19a0285ca0d796ad984d
Instruction ID: 73b962a638aad0ffd2dbd3af96f48be7167c2d91e47a15f2993d32199f022659
Opcode Fuzzy Hash: bf290e1a8b17e8bd775b0551079ed378151461e6e28a19a0285ca0d796ad984d
Instruction Fuzzy Hash: 3531B1B5550204AFD7219F65DC88AEB7BFCEB69740F20851EF856E2200DB30DD948B60

Function 0020989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,001E3AAF,?,?,Bad directive syntax error,0023CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 002098BC
LoadStringW.USER32(00000000,?,001E3AAF,?), ref: 002098C3

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00209987

Strings

Line %d (File "%s"):, xrefs: 0020992D
Error: , xrefs: 00209955
., xrefs: 0020996D
%s (%d) : ==> %s.: %s %s, xrefs: 002098F1
Line %d:, xrefs: 00209912

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: ce1a1b5623d7974b7aa19fc76902bec80ee4bfbc1e55fcd4cb07f87441916e2d
Instruction ID: 45d4ce8655c19fce4e5d668b7a5611362e7b704279eb3f78dbc6b15855de65b9
Opcode Fuzzy Hash: ce1a1b5623d7974b7aa19fc76902bec80ee4bfbc1e55fcd4cb07f87441916e2d
Instruction Fuzzy Hash: 30216D3281021EABCF15AF90CC0AEEE7779FF29700F044469F515660A2EB719AA8DB50

Function 0020209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 002020AB
GetClassNameW.USER32(00000000,?,00000100), ref: 002020C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0020214D

Strings

details, xrefs: 002020FB
largeicons, xrefs: 002020E1
SHELLDLL_DefView, xrefs: 002020CC
list, xrefs: 0020212F
smallicons, xrefs: 00202115

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 05121b716626ccc89d4fe25144714dcca0e1d9f215a48ad5272c42482c5f768a
Instruction ID: d31864a16f3fd206da4796c09c31369584312064872b1fa9723ee38407fedf4f
Opcode Fuzzy Hash: 05121b716626ccc89d4fe25144714dcca0e1d9f215a48ad5272c42482c5f768a
Instruction Fuzzy Hash: 96113D761A8327F6F7152620DC0FEA6B39CCB25314F20001BF709A50D3EBA1D8655A14

Function 001D8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32383d687d7313e7637335d6145f5f65b7f39790b8543a70ba7190287e28c52
Instruction ID: e4f73e3d0a6fc2a2a5226aafc1aef69de854a3f5227845b0d4772e70c0521d31
Opcode Fuzzy Hash: e32383d687d7313e7637335d6145f5f65b7f39790b8543a70ba7190287e28c52
Instruction Fuzzy Hash: E7C1F374A04349AFDF11DFA8E885BADBBB5AF29310F14419AF418A7392CB30D941CB61

Function 001DCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 001DCEB7
_free.LIBCMT ref: 001DCF22
_free.LIBCMT ref: 001DCF48
_free.LIBCMT ref: 001DCF71
_free.LIBCMT ref: 001DCFA9
_free.LIBCMT ref: 001DCFDA
_free.LIBCMT ref: 001DD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 001DD09C
_free.LIBCMT ref: 001DD0B5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: fa5571967d64059c148a1d3c410ce6651a1e2f3478736392a0ac6650eb2b4ac0
Instruction ID: 702ed6fedd57c44298a3d9977b5298cfc63a774083bf4601efa88ad90bee6211
Opcode Fuzzy Hash: fa5571967d64059c148a1d3c410ce6651a1e2f3478736392a0ac6650eb2b4ac0
Instruction Fuzzy Hash: DE6156B1904312AFDF25AFB4E885AAA7BA6EF22310F04456FF94497381D7319D01D790

Function 002350D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00235186
ShowWindow.USER32(?,00000000), ref: 002351C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 002351CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 002351D1

Part of subcall function 00236FBA: DeleteObject.GDI32(00000000), ref: 00236FE6

GetWindowLongW.USER32(?,000000F0), ref: 0023520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0023521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0023524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00235287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00235296

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 122b8fbc53d9abfaaf4a4469b1aad5e4bf5ab092f48ea32aae52fc33cd72848d
Instruction ID: acd1a0159aef8667c3b5d8aa27386c00f4295d3d669f92e8011eb7272b47d054
Opcode Fuzzy Hash: 122b8fbc53d9abfaaf4a4469b1aad5e4bf5ab092f48ea32aae52fc33cd72848d
Instruction Fuzzy Hash: 4A51B3B0A70A29BFEF249F24CC4ABD93BA5EB05321F144011FE5D962E0C7B599A0DF41

Function 001B8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 001F6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 001F68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001F68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 001F68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 001F68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001B8874,00000000,00000000,00000000,000000FF,00000000), ref: 001F6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 001F691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001B8874,00000000,00000000,00000000,000000FF,00000000), ref: 001F692D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: df722fffa623ba7bdbff7785f305646ca962f05a7bdaa54afa9104525c7b7155
Instruction ID: 775ab5789bec8457dd2155aa6face861b6ba999cfe5e7e0fb82e13bf28b1cddb
Opcode Fuzzy Hash: df722fffa623ba7bdbff7785f305646ca962f05a7bdaa54afa9104525c7b7155
Instruction Fuzzy Hash: 2A518A70600209EFDB24CF28DD55FAA7BB9FF58B50F204518FA16A72A0DB70E991DB50

Function 0021C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0021C182
GetLastError.KERNEL32 ref: 0021C195
SetEvent.KERNEL32(?), ref: 0021C1A9

Part of subcall function 0021C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0021C272
Part of subcall function 0021C253: GetLastError.KERNEL32 ref: 0021C322
Part of subcall function 0021C253: SetEvent.KERNEL32(?), ref: 0021C336
Part of subcall function 0021C253: InternetCloseHandle.WININET(00000000), ref: 0021C341

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 89bddc0022e687f2cbaa8b1ef1858f6e53cb250ea7095047030a8925d6e348ad
Instruction ID: cf9d642dca9c7672c597b3489fbbf7571a3baaee84a3e7f16025a43e48f2bca6
Opcode Fuzzy Hash: 89bddc0022e687f2cbaa8b1ef1858f6e53cb250ea7095047030a8925d6e348ad
Instruction Fuzzy Hash: 5F318375190601BFDB219FA5DC48AA7BBF9FF68300B20441EFD5692610D730E864DF60

Function 002025A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00203A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00203A57
Part of subcall function 00203A3D: GetCurrentThreadId.KERNEL32 ref: 00203A5E
Part of subcall function 00203A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002025B3), ref: 00203A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 002025BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 002025DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 002025DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 002025E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00202601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00202605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0020260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00202623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00202627

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 60965bdb9951c1a6dcc47e8ced2c9e045f09c6fa05c82f227a71cb67790044bb
Instruction ID: 2aaaf1c88bae0283109252665b2785b511da7a1be586a8bbc0e7a024f55ef102
Opcode Fuzzy Hash: 60965bdb9951c1a6dcc47e8ced2c9e045f09c6fa05c82f227a71cb67790044bb
Instruction Fuzzy Hash: 6A01D4317A0310BBFB106768AC8EF593F5DDB8EB12F200012F358BE0D2C9E224549E69

Function 00201803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00201449,?,?,00000000), ref: 0020180C
HeapAlloc.KERNEL32(00000000,?,00201449,?,?,00000000), ref: 00201813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00201449,?,?,00000000), ref: 00201828
GetCurrentProcess.KERNEL32(?,00000000,?,00201449,?,?,00000000), ref: 00201830
DuplicateHandle.KERNEL32(00000000,?,00201449,?,?,00000000), ref: 00201833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00201449,?,?,00000000), ref: 00201843
GetCurrentProcess.KERNEL32(00201449,00000000,?,00201449,?,?,00000000), ref: 0020184B
DuplicateHandle.KERNEL32(00000000,?,00201449,?,?,00000000), ref: 0020184E
CreateThread.KERNEL32(00000000,00000000,00201874,00000000,00000000,00000000), ref: 00201868

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4534762e018a8021342e86d0f862ccc2fa2dcf9b725f1bc1eebf8a6152accda0
Instruction ID: 95396961fa61b9c2009e89e5158b14f957912934614b3b3232b129d96f41d623
Opcode Fuzzy Hash: 4534762e018a8021342e86d0f862ccc2fa2dcf9b725f1bc1eebf8a6152accda0
Instruction Fuzzy Hash: 4C01BF75240304BFE710AB65EC4DF573B6CEB89B11F104411FA45DB191C670D810DB20

Function 0022A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0020D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0020D501
Part of subcall function 0020D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0020D50F
Part of subcall function 0020D4DC: CloseHandle.KERNEL32(00000000), ref: 0020D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0022A16D
GetLastError.KERNEL32 ref: 0022A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0022A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0022A268
GetLastError.KERNEL32(00000000), ref: 0022A273
CloseHandle.KERNEL32(00000000), ref: 0022A2C4

Strings

SeDebugPrivilege, xrefs: 0022A18F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 039d76734698be3be051a67754bcc599fe39b260a9682b65700ea7b4ea475e28
Instruction ID: 34f799f3398ecdbef060d76c7a11a8acaa1aef218344adbafd32b0a4a2103512
Opcode Fuzzy Hash: 039d76734698be3be051a67754bcc599fe39b260a9682b65700ea7b4ea475e28
Instruction Fuzzy Hash: C761C034214252EFD720DF58D894F15BBE1AF54318F18858CE86A8BBA3C772EC55CB92

Function 00233886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00233925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0023393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00233954
_wcslen.LIBCMT ref: 00233999
SendMessageW.USER32(?,00001057,00000000,?), ref: 002339C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 002339F4

Strings

SysListView32, xrefs: 002338F7

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 6ee3fdac7329c99da0bee33048f0bbb1edaa2fb128d294e4b3d03352c9e30ec7
Instruction ID: 163015b82cbfe88bc093c7760a1b0b2ab24a8e8bd759b8a04b39f70adbc25310
Opcode Fuzzy Hash: 6ee3fdac7329c99da0bee33048f0bbb1edaa2fb128d294e4b3d03352c9e30ec7
Instruction Fuzzy Hash: 2A41B471A10219ABEB21DF64CC49FEA77A9EF08350F100526F548E7281D771DAA0CB90

Function 0020BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0020BCFD
IsMenu.USER32(00000000), ref: 0020BD1D
CreatePopupMenu.USER32 ref: 0020BD53
GetMenuItemCount.USER32(01595CB8), ref: 0020BDA4
InsertMenuItemW.USER32(01595CB8,?,00000001,00000030), ref: 0020BDCC

Strings

0, xrefs: 0020BCA8
2, xrefs: 0020BD37

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: e387e417d30d328c25eaead6342f5b02c8db96c18b1bc3d8a073369fc833fa4a
Instruction ID: d16a52cdb081d3e0fbaa20faabec7c93e8c9dbd8385f03a01bd5e52e0dd498cd
Opcode Fuzzy Hash: e387e417d30d328c25eaead6342f5b02c8db96c18b1bc3d8a073369fc833fa4a
Instruction Fuzzy Hash: 64518F70A20306DBDF22DFA8D888BAEFBF4AF55314F244259E411A72D2D7709951CB61

Function 0020C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0020C913

Strings

warning, xrefs: 0020C8FC
blank, xrefs: 0020C895
info, xrefs: 0020C8B4
question, xrefs: 0020C8CC
stop, xrefs: 0020C8E4

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 4c7d25b9585145d58a3cef60a08c7667a8ba8400bff36c2cd59f80abed8f821c
Instruction ID: b89e8fb5573a9ace86ee98e15df9b5a80099b46120441c1fe51c920ed3728a6b
Opcode Fuzzy Hash: 4c7d25b9585145d58a3cef60a08c7667a8ba8400bff36c2cd59f80abed8f821c
Instruction Fuzzy Hash: F2112B716A930BBAE7065F14DC82DBA679CDF25314F30412EF904A72C3D7B0DD505268

Function 0020DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0020DE42
gethostname.WSOCK32(?,00000100), ref: 0020DE5C
gethostbyname.WSOCK32(?), ref: 0020DE69
inet_ntoa.WSOCK32(?), ref: 0020DEAB
_strcat.LIBCMT ref: 0020DEB9
WSACleanup.WSOCK32 ref: 0020DEDE

Strings

0.0.0.0, xrefs: 0020DE87

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 4f84cc330998d971021a64858403476075c6844c5b108b722418e9f10007539e
Instruction ID: d1508e2fe5251a174a898b1dadbabba06617927c736c7b66267cf3247ec25d70
Opcode Fuzzy Hash: 4f84cc330998d971021a64858403476075c6844c5b108b722418e9f10007539e
Instruction Fuzzy Hash: 80110672914215AFDB20ABB0EC0AEEE77ACDF25714F110169F505AA0D2EF71CA918B60

Function 00239F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

GetSystemMetrics.USER32(0000000F), ref: 00239FC7
GetSystemMetrics.USER32(0000000F), ref: 00239FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0023A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0023A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0023A263
ShowWindow.USER32(00000003,00000000), ref: 0023A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0023A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0023A2CA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 2c933f14d8641660548cc87f54889b39a8c86ddcfe8fd37264126cf2d6c5aab6
Instruction ID: 8d9e30fbd0a7318679ab34a6118e908212d86dc4eb160f0a326570758f8cc43d
Opcode Fuzzy Hash: 2c933f14d8641660548cc87f54889b39a8c86ddcfe8fd37264126cf2d6c5aab6
Instruction Fuzzy Hash: 1AB1CBB1610216DFDF14CF68C989BAE7BB2FF44701F188079EC89AB295D731A960CB51

Function 0020ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0020ED2A
_wcslen.LIBCMT ref: 0020ED3B
_wcslen.LIBCMT ref: 0020ED79
_wcslen.LIBCMT ref: 0020EDAF
_wcslen.LIBCMT ref: 0020EDDF
_wcslen.LIBCMT ref: 0020EDEF
_wcslen.LIBCMT ref: 0020EE2B
_wcslen.LIBCMT ref: 0020EE5A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: c8161f422a4388e9b07f274a7b3ea370e059176dd10cdcbf99a2ef5d165ed661
Instruction ID: 82eedb3b9bc01cdb32bf29eb86c0f9cda5cbed3fbc1f505891717e08b3653dd2
Opcode Fuzzy Hash: c8161f422a4388e9b07f274a7b3ea370e059176dd10cdcbf99a2ef5d165ed661
Instruction Fuzzy Hash: 0141A465C1021876CB11EBF4C88AFCFB7ACAF65310F50886AE518E3562FB34D255C3A6

Function 001BF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 001BF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 001FF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 001FF454

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: a94474650fe59684785a8e16681da61e111aa4e1687fcbedc17e20eccea7d286
Instruction ID: 0f7f51e3b2c75db0f8b30d8af803a83c0869b061eaca891c0298576a7f188188
Opcode Fuzzy Hash: a94474650fe59684785a8e16681da61e111aa4e1687fcbedc17e20eccea7d286
Instruction Fuzzy Hash: 6C412631208680FAC7398B29DC8C7BA7B96AF56318F15403CF18762560C772A883CB11

Function 00232D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00232D1B
GetDC.USER32(00000000), ref: 00232D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00232D2E
ReleaseDC.USER32(00000000,00000000), ref: 00232D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00232D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00232D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00235A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00232DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00232DE1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: ca0b9e1264b649b14156b4ee154814907270bbdd4599a73b800f9c8f2e96690b
Instruction ID: 09fec3d2366d09ff650106a74a9c74ecc5f98f4aa1a6ce99a7338706cc73e4a7
Opcode Fuzzy Hash: ca0b9e1264b649b14156b4ee154814907270bbdd4599a73b800f9c8f2e96690b
Instruction Fuzzy Hash: EC31AE72211214BFEB258F50DC8AFEB3FADEF49711F144055FE08AA291C6759C50CBA0

Function 00205622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00205637
_memcmp.LIBVCRUNTIME ref: 00205659
_memcmp.LIBVCRUNTIME ref: 00205671
_memcmp.LIBVCRUNTIME ref: 00205684
_memcmp.LIBVCRUNTIME ref: 0020569E
_memcmp.LIBVCRUNTIME ref: 002056B1
_memcmp.LIBVCRUNTIME ref: 002056C9
_memcmp.LIBVCRUNTIME ref: 002056E4

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 995c194ab7f3eb8bed1fdb9fdf75b667fb638843982103253444986298349a0c
Instruction ID: a49f42d87595ae2cf6ee22e9bd23f04d0b913d500bd576fd28e90844442d4c2d
Opcode Fuzzy Hash: 995c194ab7f3eb8bed1fdb9fdf75b667fb638843982103253444986298349a0c
Instruction Fuzzy Hash: 2821F8A1AB0B6A77D31499109F82FBB635DBE32398F441025FD045A5C3F762ED308DA5

Function 00224FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00225007
NULL Pointer assignment, xrefs: 0022502E, 00225383

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 636c35f7bcc270aa06d38ccb2662f623fa93193aa984e6b44004396b9c2748a9
Instruction ID: 65787fa3d0c59ed55e717e6a1f5a693df3ce2cbe8f04e392ec50d042b64242ef
Opcode Fuzzy Hash: 636c35f7bcc270aa06d38ccb2662f623fa93193aa984e6b44004396b9c2748a9
Instruction Fuzzy Hash: 19D1C471A1062AAFDF10CF98E880BAEB7B5FF48344F14C169E915AB281E770DD51CB90

Function 001E1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 001E15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 001E1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001E16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 001E16FB

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001E1777
__freea.LIBCMT ref: 001E17A2
__freea.LIBCMT ref: 001E17AE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 261cd858d101c2eb1b782df3cecd4ff33449babd2a7177db2a690c776e27b499
Instruction ID: a7e69e4602aeaa7753aebd9863442574cc88a02e3f7f5840d1e8c058186633af
Opcode Fuzzy Hash: 261cd858d101c2eb1b782df3cecd4ff33449babd2a7177db2a690c776e27b499
Instruction Fuzzy Hash: 3F91D672E00A96BADF248FB6C881EEE7BB5AF4A710F184659E912E7140D735CD40CB60

Function 00224523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00224648
VariantInit.OLEAUT32(?), ref: 00224749
VariantClear.OLEAUT32(?), ref: 00224753
VariantClear.OLEAUT32(?), ref: 002247B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0022472C
Null Object assignment in FOR..IN loop, xrefs: 002245D8, 00224706, 002247BE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 1c28b22a9246e6970c6ff17b608c71caad3237ffeb98132536dbcdb0962310d6
Instruction ID: a5f78a023e6e56d5ac158c9fbc26aa0e0ee5169e45f132881d1270c43f6a27f5
Opcode Fuzzy Hash: 1c28b22a9246e6970c6ff17b608c71caad3237ffeb98132536dbcdb0962310d6
Instruction Fuzzy Hash: 0B91A170A20225BBDF24DFA4E844FAEBBB8EF46714F108559F515AB280D7B09951CFA0

Function 00211187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0021125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00211284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 002112A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002112D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0021135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002113C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00211430

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 18beb5b330f5854a0aa56f4ff7f06296d8513825058ce8265941171976a76f52
Instruction ID: edd2484898eb2076ee2f5c8dfc9df5c5f7c222951430541fed892d168b200849
Opcode Fuzzy Hash: 18beb5b330f5854a0aa56f4ff7f06296d8513825058ce8265941171976a76f52
Instruction Fuzzy Hash: 1E911375A10219AFEB00DFA8D884BFEB7F5FF65714F104029EA00E7291D774A9A1CB90

Function 001B948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: ddee39f265c94e06df2c5dcea781766cae7810ef044797300c2301fc94930fbf
Instruction ID: daf8b694e6b97e20112829c028bed4ea6828c725ef3fe0b268616a5a02f360a7
Opcode Fuzzy Hash: ddee39f265c94e06df2c5dcea781766cae7810ef044797300c2301fc94930fbf
Instruction Fuzzy Hash: 55914A71D40219EFCB14CFA9CC88AEEBBB8FF49320F144156E615B7291D374AA42CB60

Function 00223947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0022396B
CharUpperBuffW.USER32(?,?), ref: 00223A7A
_wcslen.LIBCMT ref: 00223A8A
VariantClear.OLEAUT32(?), ref: 00223C1F

Part of subcall function 00210CDF: VariantInit.OLEAUT32(00000000), ref: 00210D1F
Part of subcall function 00210CDF: VariantCopy.OLEAUT32(?,?), ref: 00210D28
Part of subcall function 00210CDF: VariantClear.OLEAUT32(?), ref: 00210D34

Strings

AUTOIT.ERROR, xrefs: 00223A80, 00223A85
Incorrect Parameter format, xrefs: 002239A6, 00223BA1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 98cc658776434c2375e39da31ac41eadbcbdc9972d9ff19ae19c594f85fc3947
Instruction ID: 9c551da3d9ab61de50e6b2231fb9c67ec8e50604a6877ec9002237e535f78dc5
Opcode Fuzzy Hash: 98cc658776434c2375e39da31ac41eadbcbdc9972d9ff19ae19c594f85fc3947
Instruction Fuzzy Hash: 8E917774A18315AFC700EF64D48096AB7E4FF99314F14882EF88A9B351DB34EE55CB92

Function 00224BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0020000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?,?,0020035E), ref: 0020002B
Part of subcall function 0020000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200046
Part of subcall function 0020000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200054
Part of subcall function 0020000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?), ref: 00200064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00224C51
_wcslen.LIBCMT ref: 00224D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00224DCF
CoTaskMemFree.OLE32(?), ref: 00224DDA

Strings

NULL Pointer assignment, xrefs: 00224E23, 00224E52

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 4b19cb483c4150b2e763774e7a2c6155fed0e5543dd88d8e93c16e7e65750303
Instruction ID: ac4119267938a6947fbf8b212b66678b2a05e5acc7ae7b80fd95d98f5a5910f7
Opcode Fuzzy Hash: 4b19cb483c4150b2e763774e7a2c6155fed0e5543dd88d8e93c16e7e65750303
Instruction Fuzzy Hash: E3913871D1022DAFDF15EFE4D880AEEB7B9BF08304F10816AE915AB251DB749A54CF60

Function 002320FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00232183
GetMenuItemCount.USER32(00000000), ref: 002321B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 002321DD
_wcslen.LIBCMT ref: 00232213
GetMenuItemID.USER32(?,?), ref: 0023224D
GetSubMenu.USER32(?,?), ref: 0023225B

Part of subcall function 00203A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00203A57
Part of subcall function 00203A3D: GetCurrentThreadId.KERNEL32 ref: 00203A5E
Part of subcall function 00203A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002025B3), ref: 00203A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002322E3

Part of subcall function 0020E97B: Sleep.KERNELBASE ref: 0020E9F3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: c00eddcf3ab585a13bb9efe3c2135693f3e2720a812eb32de1995980acb92b7f
Instruction ID: b38af5441f6f6738993af15248de20a788dc8502ad89afe1d8ed2f9e6588a4da
Opcode Fuzzy Hash: c00eddcf3ab585a13bb9efe3c2135693f3e2720a812eb32de1995980acb92b7f
Instruction Fuzzy Hash: F4718CB5A10205EFCB10EF68C885AAEB7F5EF48310F108459E956BB351DB34EE558B90

Function 00237E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01595A10), ref: 00237F37
IsWindowEnabled.USER32(01595A10), ref: 00237F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0023801E
SendMessageW.USER32(01595A10,000000B0,?,?), ref: 00238051
IsDlgButtonChecked.USER32(?,?), ref: 00238089
GetWindowLongW.USER32(01595A10,000000EC), ref: 002380AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 002380C3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: f22d7a747a0a20609d9824df16c1ef2f2259e8052947aa482229cb4e0d33982e
Instruction ID: f1a29fe512aa080611df2d8cfb0bc515e2c9ac638257fdd26367c2425d350af7
Opcode Fuzzy Hash: f22d7a747a0a20609d9824df16c1ef2f2259e8052947aa482229cb4e0d33982e
Instruction Fuzzy Hash: C2719DF4628306AFEF359F64C884FAABBB9FF19300F144059F94597261CB31A865DB20

Function 0020AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0020AEF9
GetKeyboardState.USER32(?), ref: 0020AF0E
SetKeyboardState.USER32(?), ref: 0020AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0020AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0020AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0020AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0020B020

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d21b5344bd1a2d2b5a98f0cedb786643a1379857d29c4680bbe1ddc42f1d453d
Instruction ID: 06bde4ab9ec79db26d8962c1dadd68855736f9b96754a925e46aed69bf6c8f62
Opcode Fuzzy Hash: d21b5344bd1a2d2b5a98f0cedb786643a1379857d29c4680bbe1ddc42f1d453d
Instruction Fuzzy Hash: FE51B1A0A247D73DFB378734C849BBABEA95B06304F088589E1D9958C3C3D9A8E4D751

Function 0020ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0020AD19
GetKeyboardState.USER32(?), ref: 0020AD2E
SetKeyboardState.USER32(?), ref: 0020AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0020ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0020ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0020AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0020AE38

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9e64ffc5f23c9ef9d8493799abdb258b828808051984dcc6fa3c785c9d726851
Instruction ID: 1826eea7ffc51a825084b1ccab143e4f158ccc24db764e8646581a3d156f2c35
Opcode Fuzzy Hash: 9e64ffc5f23c9ef9d8493799abdb258b828808051984dcc6fa3c785c9d726851
Instruction Fuzzy Hash: 475129A19247D23DFB378B34CC46B7A7EE86B46300F488499E1D5568C3D394ECA8D752

Function 001D542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(001E3CD6,?,?,?,?,?,?,?,?,001D5BA3,?,?,001E3CD6,?,?), ref: 001D5470
__fassign.LIBCMT ref: 001D54EB
__fassign.LIBCMT ref: 001D5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,001E3CD6,00000005,00000000,00000000), ref: 001D552C
WriteFile.KERNEL32(?,001E3CD6,00000000,001D5BA3,00000000,?,?,?,?,?,?,?,?,?,001D5BA3,?), ref: 001D554B
WriteFile.KERNEL32(?,?,00000001,001D5BA3,00000000,?,?,?,?,?,?,?,?,?,001D5BA3,?), ref: 001D5584

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 9568c6054c607eed77334cce2c97e4f45be50e0c249f3cb745b6816502d3c351
Instruction ID: 0694b93f22d235f8ae1da6278b966c4405932f620e0f8725c88288b39dad5c1f
Opcode Fuzzy Hash: 9568c6054c607eed77334cce2c97e4f45be50e0c249f3cb745b6816502d3c351
Instruction Fuzzy Hash: A451A3719006499FDB11CFA8E885AEEBBFAEF09300F14415BE555E7391D730DA41CB61

Function 001C2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001C2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 001C2D53
_ValidateLocalCookies.LIBCMT ref: 001C2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 001C2E0C
_ValidateLocalCookies.LIBCMT ref: 001C2E61

Strings

csm, xrefs: 001C2DF6

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e7674fb35dcbb9b662c7f024650dad4871c7519cafa6425d4eb069d7bdc0cdba
Instruction ID: 5675f46e842f53df3dca9693fc3db633021293df73805e3236005f3a94acbb21
Opcode Fuzzy Hash: e7674fb35dcbb9b662c7f024650dad4871c7519cafa6425d4eb069d7bdc0cdba
Instruction Fuzzy Hash: 6041D334A00209ABCF14DFA8C845FAEBBB4BF65324F148159E9156B392D731DA01CBD1

Function 002210B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0022304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0022307A
Part of subcall function 0022304E: _wcslen.LIBCMT ref: 0022309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00221112
WSAGetLastError.WSOCK32 ref: 00221121
WSAGetLastError.WSOCK32 ref: 002211C9
closesocket.WSOCK32(00000000), ref: 002211F9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 1d7da383248763e7c02168dae7b6949ef04511fe9054e4a717f51ef3a19d6633
Instruction ID: ac48b488d1aed1251eb3caee900e23345fcd03231482c0d9d4a3b44ff081cab4
Opcode Fuzzy Hash: 1d7da383248763e7c02168dae7b6949ef04511fe9054e4a717f51ef3a19d6633
Instruction Fuzzy Hash: 38412735610214AFDB109F64E884FA9B7E9FF55324F148059FD09AB291C770EE61CBE1

Function 0020CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0020CF22,?), ref: 0020DDFD

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0020CF22,?), ref: 0020DE16

lstrcmpiW.KERNEL32(?,?), ref: 0020CF45
MoveFileW.KERNEL32(?,?), ref: 0020CF7F
_wcslen.LIBCMT ref: 0020D005
_wcslen.LIBCMT ref: 0020D01B
SHFileOperationW.SHELL32(?), ref: 0020D061

Strings

\*.*, xrefs: 0020CFF3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 4fa771d79e12dbdb8f854e20e8ab9f24f05aa28b303440e4f9f83fd8a2674104
Instruction ID: f00bdfcd643699559e98f43828264cf9aa0d5c817fb8ecb2f8488f39e53c6aea
Opcode Fuzzy Hash: 4fa771d79e12dbdb8f854e20e8ab9f24f05aa28b303440e4f9f83fd8a2674104
Instruction Fuzzy Hash: C54167B18152195FDF12EFA4D985ADEB7B9AF18340F1000E6E505E7182EB34A694CF51

Function 00232DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00232E1C
GetWindowLongW.USER32(?,000000F0), ref: 00232E4F
GetWindowLongW.USER32(?,000000F0), ref: 00232E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00232EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00232EE0
GetWindowLongW.USER32(?,000000F0), ref: 00232EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00232F0B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: adf52c07ae1d64fb7bb71922b8ab5994f4541dc87e1b2dea3b18f4d5492ba3ab
Instruction ID: ca39ea638453afac642717d024473884535b1bb3991ad8e00b48eafbb39c8d64
Opcode Fuzzy Hash: adf52c07ae1d64fb7bb71922b8ab5994f4541dc87e1b2dea3b18f4d5492ba3ab
Instruction Fuzzy Hash: E4311371614251EFDB21CF18EC8AF6537E4EB8AB10F240164FA049B2B2CB71B8A5DB40

Function 00207726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00207769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0020778F
SysAllocString.OLEAUT32(00000000), ref: 00207792
SysAllocString.OLEAUT32(?), ref: 002077B0
SysFreeString.OLEAUT32(?), ref: 002077B9
StringFromGUID2.OLE32(?,?,00000028), ref: 002077DE
SysAllocString.OLEAUT32(?), ref: 002077EC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7a49141580321292a3adaa7d55d5567315a5fcdcdf117eed758c9cd03da292ad
Instruction ID: a7d8a84bab9a6b13c6a427582620602fe377e731d413ca8d278416540e28eef5
Opcode Fuzzy Hash: 7a49141580321292a3adaa7d55d5567315a5fcdcdf117eed758c9cd03da292ad
Instruction Fuzzy Hash: E621C476A14319AFDF10EFA8DC88CBBB3ACEB093A47108025FA04DB1A1D770EC518760

Function 002077FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00207842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00207868
SysAllocString.OLEAUT32(00000000), ref: 0020786B
SysAllocString.OLEAUT32 ref: 0020788C
SysFreeString.OLEAUT32 ref: 00207895
StringFromGUID2.OLE32(?,?,00000028), ref: 002078AF
SysAllocString.OLEAUT32(?), ref: 002078BD

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 48b3dc125e4e6d1353cff8dfdb270bd19d3ac2cdb2789cb5063725bd1deb530e
Instruction ID: 5ac77aa757c45beb3e4be62a4fd6b05c91d58a000c50df457f48977bde65f417
Opcode Fuzzy Hash: 48b3dc125e4e6d1353cff8dfdb270bd19d3ac2cdb2789cb5063725bd1deb530e
Instruction Fuzzy Hash: A1216232A18205AFDB10AFA8DC8CDAA77ACEB097607108125FA15DB2A1D774EC51DB64

Function 002104D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 002104F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0021052E

Strings

nul, xrefs: 00210567

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a757c8f4b34403c41d5515d632ef3cbbf985731c67f0a579f4871a985a600cec
Instruction ID: a5f376ffb75e4dfdb6a63825f597ea5db6d467f7bc842865a48dd1b78bcb14c8
Opcode Fuzzy Hash: a757c8f4b34403c41d5515d632ef3cbbf985731c67f0a579f4871a985a600cec
Instruction Fuzzy Hash: 4F218571510306ABDB205F29DC88ADA77E5BF54724F604A19FCA1E61D0D7F099E0CF20

Function 002105A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002105C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00210601

Strings

nul, xrefs: 00210639

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 5d988e0d6aef9e4186e36245a9bd67568be98f1dc1ce1d4e5cfb08bc8312e81e
Instruction ID: 3d2b7062f5b210efe471c97b980448b4cf9d012b2cf333a99b2142474cc7abb4
Opcode Fuzzy Hash: 5d988e0d6aef9e4186e36245a9bd67568be98f1dc1ce1d4e5cfb08bc8312e81e
Instruction Fuzzy Hash: 3B2153755103469BDB209F699C88ADA77E8BFA5720F204A19FCA1E72D0D7F099F0CB50

Function 002340AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A604C
Part of subcall function 001A600E: GetStockObject.GDI32(00000011), ref: 001A6060
Part of subcall function 001A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 001A606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00234112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0023411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0023412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00234139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00234145

Strings

Msctls_Progress32, xrefs: 002340E3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ce9417f8c69dda23e06e8f0725b1b8e3eb15fff82f5b43ab4bdd7fd0922dcdb7
Instruction ID: 4f93013ce4e3fde4e3b1e7fa25a3cb30b0c085902ea0416147fb7c92dd39abdd
Opcode Fuzzy Hash: ce9417f8c69dda23e06e8f0725b1b8e3eb15fff82f5b43ab4bdd7fd0922dcdb7
Instruction Fuzzy Hash: 5411B2B215021ABEEF119F64CC86EE77F6DEF09798F014111FA58A6050CB729C61DBA4

Function 001DD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001DD7A3: _free.LIBCMT ref: 001DD7CC

_free.LIBCMT ref: 001DD82D

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DD838
_free.LIBCMT ref: 001DD843
_free.LIBCMT ref: 001DD897
_free.LIBCMT ref: 001DD8A2
_free.LIBCMT ref: 001DD8AD
_free.LIBCMT ref: 001DD8B8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: cbc18e0a9550c0fe51c718776e67c20982726d44ffdfc239b5484901b739cfee
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 5E115E71540B14AAD621BFF0DC47FCB7BDCAF20704F400826F2ADA6292DB75B5059661

Function 0020DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0020DA74
LoadStringW.USER32(00000000), ref: 0020DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0020DA91
LoadStringW.USER32(00000000), ref: 0020DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0020DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0020DAB9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: b6c23032227471da425e6df53002bee1bd1e409757576a5b0a78d65a2b5c132c
Instruction ID: 1445a81f81f4a738d42bd7515ee23294549e3c83f82a3b79da34bcc59ed056c2
Opcode Fuzzy Hash: b6c23032227471da425e6df53002bee1bd1e409757576a5b0a78d65a2b5c132c
Instruction Fuzzy Hash: 350162F29102087FE7109BA4AD8DEE7726CE708301F500896B746F2082EA749E844F74

Function 0021096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0158C8B0,0158C8B0), ref: 0021097B
EnterCriticalSection.KERNEL32(0158C890,00000000), ref: 0021098D
TerminateThread.KERNEL32(?,000001F6), ref: 0021099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 002109A9
CloseHandle.KERNEL32(?), ref: 002109B8
InterlockedExchange.KERNEL32(0158C8B0,000001F6), ref: 002109C8
LeaveCriticalSection.KERNEL32(0158C890), ref: 002109CF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: e7c0dfa24f4604dfa848b7c593a06991587c537c458fbad97a9dcf4559c3fd7d
Instruction ID: 5575cd7480b1d3479e5c05c1328931c0018b26decd6ed63535ff658833151c36
Opcode Fuzzy Hash: e7c0dfa24f4604dfa848b7c593a06991587c537c458fbad97a9dcf4559c3fd7d
Instruction Fuzzy Hash: 02F0CD31442512ABD7515F94EE8DAD67A65BF05702F501025F501608A1C7B5A4B5CF90

Function 001A5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001A5D30
GetWindowRect.USER32(?,?), ref: 001A5D71
ScreenToClient.USER32(?,?), ref: 001A5D99
GetClientRect.USER32(?,?), ref: 001A5ED7
GetWindowRect.USER32(?,?), ref: 001A5EF8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 178e3d79a8e347d303cfc7b14ce412f11b6f6008a04f0c2dbeaee934c59ecf84
Instruction ID: 0afffcc8ed970560bc2ad7d3e0fb24401abd1a25fb5a791b2d8b95edef4002c6
Opcode Fuzzy Hash: 178e3d79a8e347d303cfc7b14ce412f11b6f6008a04f0c2dbeaee934c59ecf84
Instruction Fuzzy Hash: E5B17B39A04B8ADBDB14CFA9C4407EEB7F2FF58310F14841AE8A9D7250DB34AA51DB54

Function 001D01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001D00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D00D6
__allrem.LIBCMT ref: 001D00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D010B
__allrem.LIBCMT ref: 001D0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D0140

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 4b0162c3defa73debad09faea933bf64313f38eb058c32900e9d06167ff5d322
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: BF81E372A00B06ABE7259A69CC82B6B73E9EF65364F25423FF411D7381E770D9018790

Function 00221D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00223149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0022101C,00000000,?,?,00000000), ref: 00223195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00221DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00221DE1
WSAGetLastError.WSOCK32 ref: 00221DF2
inet_ntoa.WSOCK32(?), ref: 00221E8C
htons.WSOCK32(?,?,?,?,?), ref: 00221EDB
_strlen.LIBCMT ref: 00221F35

Part of subcall function 002039E8: _strlen.LIBCMT ref: 002039F2

Part of subcall function 001A6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,001BCF58,?,?,?), ref: 001A6DBA
Part of subcall function 001A6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,001BCF58,?,?,?), ref: 001A6DED

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 7e66e94be39c3b475b517182f0ae9f129c93981bd95d6a76509cf735ec8072bc
Instruction ID: e189ad3ab38ad3a1eb12d76d5d295eba2930301286e8fea16272c9f79d88e2c3
Opcode Fuzzy Hash: 7e66e94be39c3b475b517182f0ae9f129c93981bd95d6a76509cf735ec8072bc
Instruction Fuzzy Hash: C1A13334204311AFC320DF60D885F2A7BE5AFA5318F54894CF45A5B2E2CB71EE52CB91

Function 001D61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,001C82D9,001C82D9,?,?,?,001D644F,00000001,00000001,8BE85006), ref: 001D6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001D644F,00000001,00000001,8BE85006,?,?,?), ref: 001D62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001D63D8
__freea.LIBCMT ref: 001D63E5

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

__freea.LIBCMT ref: 001D63EE
__freea.LIBCMT ref: 001D6413

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7e31dba642cf104dc07465e2cd0c0d8f56c6881c7bcfa5f83b17535776c4791d
Instruction ID: 45c2507b0b41a17764cb693653e0b73d931ff5ce1dd89df192d788711326c50a
Opcode Fuzzy Hash: 7e31dba642cf104dc07465e2cd0c0d8f56c6881c7bcfa5f83b17535776c4791d
Instruction Fuzzy Hash: CD51B072A00216BBEB258F64DC81EAF77A9EB54750F25472AFC09D6241EB34DC44D6A0

Function 0022BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0022BD25
RegCloseKey.ADVAPI32(00000000), ref: 0022BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0022BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0022BDF3
RegCloseKey.ADVAPI32(?), ref: 0022BDFF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 7258bd70ed5eb9a3c435ae19571c44ec0559284cbdff5e64022cf0b39ce7ea8e
Instruction ID: ecd1e9c665cdcc431c8708666cb679410c38071ca05246027879dca62a36db01
Opcode Fuzzy Hash: 7258bd70ed5eb9a3c435ae19571c44ec0559284cbdff5e64022cf0b39ce7ea8e
Instruction Fuzzy Hash: 1F81FE34228241EFC715DF64D885E6ABBE5FF85308F14886CF4598B2A2CB31ED45CB92

Function 001FF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 001FF7B9
SysAllocString.OLEAUT32(00000001), ref: 001FF860
VariantCopy.OLEAUT32(001FFA64,00000000), ref: 001FF889
VariantClear.OLEAUT32(001FFA64), ref: 001FF8AD
VariantCopy.OLEAUT32(001FFA64,00000000), ref: 001FF8B1
VariantClear.OLEAUT32(?), ref: 001FF8BB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: c041de0d3052e3b6a06cd3cafdf99dafc93c412421dfee8a982f8c7fe4cf9160
Instruction ID: 52688fbd250527d02bc7e5cf3d8dab7894b64938c9d386c6f725d25bc3d6a9ab
Opcode Fuzzy Hash: c041de0d3052e3b6a06cd3cafdf99dafc93c412421dfee8a982f8c7fe4cf9160
Instruction Fuzzy Hash: E651E635500318BACF24AB65D895B39B3A4FF55314F24846EFA06DF292DBF08C42DB96

Function 0021910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 002194E5
_wcslen.LIBCMT ref: 00219506
_wcslen.LIBCMT ref: 0021952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00219585

Strings

X, xrefs: 00219412

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 1c67402a0d00173ac81b91a3fa7ed866e7938806d9d34fe35042acde70376ee1
Instruction ID: 6cfef8b9366f007e199a8e81ca586c204172846ceb517d78baa6e2887bb05974
Opcode Fuzzy Hash: 1c67402a0d00173ac81b91a3fa7ed866e7938806d9d34fe35042acde70376ee1
Instruction Fuzzy Hash: 99E1F435518341DFC724DF24C891BAAB7E5BFA5310F04896CF8999B2A2DB30DD85CB92

Function 001B920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

BeginPaint.USER32(?,?,?), ref: 001B9241
GetWindowRect.USER32(?,?), ref: 001B92A5
ScreenToClient.USER32(?,?), ref: 001B92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 001B92D3
EndPaint.USER32(?,?,?,?,?), ref: 001B9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 001F71EA

Part of subcall function 001B9339: BeginPath.GDI32(00000000), ref: 001B9357

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: b9e0a5633ff83fa2b22bc9b1599d3529db182a42a1b0495ee7b8c4d44c888746
Instruction ID: a148ef96e2ed5ad16d8c036ea1bbd449df27d9e90ae3c3711d513b911068f2c8
Opcode Fuzzy Hash: b9e0a5633ff83fa2b22bc9b1599d3529db182a42a1b0495ee7b8c4d44c888746
Instruction Fuzzy Hash: 6B418D71108201AFD711DF28D889FBA7BB8EF55320F140669FAA8962E1C7319846DB61

Function 002107EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0021080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00210847
EnterCriticalSection.KERNEL32(?), ref: 00210863
LeaveCriticalSection.KERNEL32(?), ref: 002108DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 002108F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00210921

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 576b3f2ee4f03fbb11b400b801156775ae19c5e518ed2ff6c6e23f8917a705ae
Instruction ID: 8b3c0250f4c6da0d77464c987c7f86c75a444825bddc51c52a94c584bd0d12f2
Opcode Fuzzy Hash: 576b3f2ee4f03fbb11b400b801156775ae19c5e518ed2ff6c6e23f8917a705ae
Instruction Fuzzy Hash: 24419A71900205EFDF14AF64DC85AAA77B9FF18700F1140A9ED04AA297DB70DEA1DBA0

Function 002381DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,001FF3AB,00000000,?,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 0023824C
EnableWindow.USER32(?,00000000), ref: 00238272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 002382D1
ShowWindow.USER32(?,00000004), ref: 002382E5
EnableWindow.USER32(?,00000001), ref: 0023830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0023832F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 2860fe9d404a7a3dc8a70f47885f2c4c1b8626b18557ef75f9e9313ba544bfc8
Instruction ID: 9f40ca01f4a2ea67a18838182ddce1d84d3245a25ce652078a4dfa42cde4645e
Opcode Fuzzy Hash: 2860fe9d404a7a3dc8a70f47885f2c4c1b8626b18557ef75f9e9313ba544bfc8
Instruction Fuzzy Hash: 2B41A370611785EFDB15CF15D899BA57BE0BF4A714F1841A9FA084F262CB31A862CF50

Function 00204C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00204C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00204CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00204CEA
_wcslen.LIBCMT ref: 00204D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00204D10
_wcsstr.LIBVCRUNTIME ref: 00204D1A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 095d6959b6782f3cfd4fcdbef059200ce1bd76f7d3bc1bcaa04edb2ed40869bf
Instruction ID: 48ca78582aea4c8407038eb0c1a3971a595925ad5d4a5ac8673d184570327cda
Opcode Fuzzy Hash: 095d6959b6782f3cfd4fcdbef059200ce1bd76f7d3bc1bcaa04edb2ed40869bf
Instruction Fuzzy Hash: CE2107B12143017BEB196F35AC4AE7B7BACDF95750F10802EF905DA192DB71DD1187A0

Function 0021581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

_wcslen.LIBCMT ref: 0021587B
CoInitialize.OLE32(00000000), ref: 00215995
CoCreateInstance.OLE32(0023FCF8,00000000,00000001,0023FB68,?), ref: 002159AE
CoUninitialize.OLE32 ref: 002159CC

Strings

.lnk, xrefs: 00215876, 002158C1, 00215985

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 98d80b35c3595b0ac810ea906a91768d3bca5b362f4ada5e35de22e140138f5c
Instruction ID: 7f2dd84bac3fc573718fe505e915951c67c39b3c0d2aedda4bc6ca11c548eb2c
Opcode Fuzzy Hash: 98d80b35c3595b0ac810ea906a91768d3bca5b362f4ada5e35de22e140138f5c
Instruction Fuzzy Hash: 9CD16474618711DFC704DF24C480A6ABBE1EFAA314F14889DF8899B361C731ED85CB92

Function 0020175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00200FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00200FCA
Part of subcall function 00200FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00200FD6
Part of subcall function 00200FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00200FE5
Part of subcall function 00200FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00200FEC
Part of subcall function 00200FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00201002

GetLengthSid.ADVAPI32(?,00000000,00201335), ref: 002017AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 002017BA
HeapAlloc.KERNEL32(00000000), ref: 002017C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 002017DA
GetProcessHeap.KERNEL32(00000000,00000000,00201335), ref: 002017EE
HeapFree.KERNEL32(00000000), ref: 002017F5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: a668a8e34dd420254058eb13d45e18b4336b1cb1ac398eb5259d5b283557119e
Instruction ID: 97ea7c443f8e8694347ca5e5e7273f165c8139cf2e8049240db62a09f2877553
Opcode Fuzzy Hash: a668a8e34dd420254058eb13d45e18b4336b1cb1ac398eb5259d5b283557119e
Instruction Fuzzy Hash: 0111B131520306FFDB149FA4DC49BAEBBF9EB45355F204018F485A71A2C7359960DB60

Function 002014CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002014FF
OpenProcessToken.ADVAPI32(00000000), ref: 00201506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00201515
CloseHandle.KERNEL32(00000004), ref: 00201520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0020154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00201563

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 31e02a43d38e5b4a2ac7a4045561dcd7d32f7eced2e1a933afbcdfe43cb45feb
Instruction ID: ecb35c6c659aedf01a1fb3f60251a9546fe93f991d23821d43b5cc1a7fdbd5b3
Opcode Fuzzy Hash: 31e02a43d38e5b4a2ac7a4045561dcd7d32f7eced2e1a933afbcdfe43cb45feb
Instruction Fuzzy Hash: A511267260024AABDF119FA8ED49BDE7BA9EF48748F144065FA05A20A1C375CE74DB60

Function 001C3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001C3379,001C2FE5), ref: 001C3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001C339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001C33B7
SetLastError.KERNEL32(00000000,?,001C3379,001C2FE5), ref: 001C3409

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1aed1c3fe83507d86e19309518f6b7edd19017df182dbd8bcc29ec7bd088c617
Instruction ID: 9f5eb09257ca458df6d69e03d8cba2abf97df551e44580b7680aebe58a3fe4f1
Opcode Fuzzy Hash: 1aed1c3fe83507d86e19309518f6b7edd19017df182dbd8bcc29ec7bd088c617
Instruction Fuzzy Hash: 2A01B13260D361AEA62937757CD9F762A94EB35379730C22EF430852F0EF51CE015694

Function 001D2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001D5686,001E3CD6,?,00000000,?,001D5B6A,?,?,?,?,?,001CE6D1,?,00268A48), ref: 001D2D78
_free.LIBCMT ref: 001D2DAB
_free.LIBCMT ref: 001D2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,001CE6D1,?,00268A48,00000010,001A4F4A,?,?,00000000,001E3CD6), ref: 001D2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,001CE6D1,?,00268A48,00000010,001A4F4A,?,?,00000000,001E3CD6), ref: 001D2DEC
_abort.LIBCMT ref: 001D2DF2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 9be319964bf72c46c1746ff65fcdb335a636423f68970dddb56c5f110d5f52af
Instruction ID: 99f5beaa3c54c1e4e813fd05a8d0d3fac11d530cad54f87fdc002538f222e3ac
Opcode Fuzzy Hash: 9be319964bf72c46c1746ff65fcdb335a636423f68970dddb56c5f110d5f52af
Instruction Fuzzy Hash: B8F0A431905E106BC62637B8BC0AA1B255BABF27A5F35442BF878A3392EF7488015261

Function 00238A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 001B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001B9693
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96A2
Part of subcall function 001B9639: BeginPath.GDI32(?), ref: 001B96B9
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00238A4E
LineTo.GDI32(?,00000003,00000000), ref: 00238A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00238A70
LineTo.GDI32(?,00000000,00000003), ref: 00238A80
EndPath.GDI32(?), ref: 00238A90
StrokePath.GDI32(?), ref: 00238AA0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 40d2075359e2f970bbc8a46a1094f9e1ffe57da8dd69308a220a3233148723fd
Instruction ID: 08df1aa3a9238a59418e1df45bec60a5ec0def05086497701a32004d9be46465
Opcode Fuzzy Hash: 40d2075359e2f970bbc8a46a1094f9e1ffe57da8dd69308a220a3233148723fd
Instruction Fuzzy Hash: 8111C97600014DFFDB129F94EC88EAA7F6DEF08354F148012BA19AA1A1C7719D65DBA0

Function 002051FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00205218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00205229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00205230
ReleaseDC.USER32(00000000,00000000), ref: 00205238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0020524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00205261

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: aa414dd039dcc264e3bed95421932c39f3ec9bf6be24d8012575791920565cfe
Instruction ID: f83e28993972d8d120e52b77d4302a81ce707673d44f944d75f52265ec876a69
Opcode Fuzzy Hash: aa414dd039dcc264e3bed95421932c39f3ec9bf6be24d8012575791920565cfe
Instruction Fuzzy Hash: 81014F76A00719BBEB109FA59C49A5EBFB8EF48751F144065FA04E7291D670DC10CFA0

Function 001A1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 001A1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 001A1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 001A1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 001A1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 001A1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 001A1C22

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: b5f73e75d3f4d159d184f7b92c1e177da4853d55127f04bb14510640d72b7104
Instruction ID: 02a9bab16ae7b07eaf9d8968e5e300c4a5aec55a88e8083258c16dd6c42c3943
Opcode Fuzzy Hash: b5f73e75d3f4d159d184f7b92c1e177da4853d55127f04bb14510640d72b7104
Instruction Fuzzy Hash: E20144B0902B5ABDE3008F6A8C85A52FEA8FF59354F00411BA15C4BA42C7B5A864CBE5

Function 0020EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0020EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0020EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0020EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0020EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0020EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0020EB75

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 902fb6af279bf8771525b237c17e805e5dcc1ca38a46c8cbaec3632c3decc720
Instruction ID: 1c97c87dda4c8f16d15645cb4b1a3096a7b9fe22736711dabff8f0e1dea69905
Opcode Fuzzy Hash: 902fb6af279bf8771525b237c17e805e5dcc1ca38a46c8cbaec3632c3decc720
Instruction Fuzzy Hash: 22F03A72240158BBE7215B62AC0EEEF3A7CEFCAB11F104158F601E1091D7A05A01DBB5

Function 001F7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 001F7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 001F7469
GetWindowDC.USER32(?), ref: 001F7475
GetPixel.GDI32(00000000,?,?), ref: 001F7484
ReleaseDC.USER32(?,00000000), ref: 001F7496
GetSysColor.USER32(00000005), ref: 001F74B0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 507645956b861a7ca1293f780527880e8a44994efbe2428a66b30f923adc6731
Instruction ID: 6a8833beac387f2cad7f834847cd783420f5843c6f94fbeda15d613c70c2e6f9
Opcode Fuzzy Hash: 507645956b861a7ca1293f780527880e8a44994efbe2428a66b30f923adc6731
Instruction Fuzzy Hash: 1E014B31500619EFEB515F64EC0DBBA7BB5FF04311F650164FA19B21A1CB311E51AF50

Function 00201874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0020187F
UnloadUserProfile.USERENV(?,?), ref: 0020188B
CloseHandle.KERNEL32(?), ref: 00201894
CloseHandle.KERNEL32(?), ref: 0020189C
GetProcessHeap.KERNEL32(00000000,?), ref: 002018A5
HeapFree.KERNEL32(00000000), ref: 002018AC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: fe7fa4505321e66624577cbed71748807bfbe03a42516720f05fbc4dda444fa4
Instruction ID: 46c3304aa76c388944dc344d2a9926a52b29036dafcf6124238a3e04c6410ac3
Opcode Fuzzy Hash: fe7fa4505321e66624577cbed71748807bfbe03a42516720f05fbc4dda444fa4
Instruction Fuzzy Hash: F7E0E536004101BBDB016FA1FD0C90ABF39FF49B22B208220F229A1070CB329430EF50

Function 001ABBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001ABEB3

Strings

D%', xrefs: 001ABDED, 001ABD91, 001ABD1B
D%'D%', xrefs: 001ABCA5
D%', xrefs: 001ABE9A
D%', xrefs: 001ABCA2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%'$D%'$D%'$D%'D%'
API String ID: 1385522511-1173686633
Opcode ID: 5873473402c31aeb7702e7d7f91a8e0da609477ec8357373551017eb9294ea72
Instruction ID: 97163c1f268626a7012b55d8bdc16fb6201f81f15e969c6e63c1ee79db5235b4
Opcode Fuzzy Hash: 5873473402c31aeb7702e7d7f91a8e0da609477ec8357373551017eb9294ea72
Instruction Fuzzy Hash: 05914A79A0424ACFCB18CF98C0D0AA9B7F1FF5A314B64816DD945AB356D731E981CB90

Function 0020C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0020C6EE
_wcslen.LIBCMT ref: 0020C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0020C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0020C7CA

Strings

0, xrefs: 0020C6AF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 734d45c52922b4b4afc653dc757bbf21a1386076a72883444e550e42e4f2eff8
Instruction ID: 111e5b4c01fc035d94f5c5492c97c8fe0c4c31994d37f2398a6c9f6fc4ea57b4
Opcode Fuzzy Hash: 734d45c52922b4b4afc653dc757bbf21a1386076a72883444e550e42e4f2eff8
Instruction Fuzzy Hash: EE51D5B16243029BD7159F28C885B6BB7ECAF95310F24072DF595D31E2D770D924CB52

Function 0022AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0022AEA3

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

GetProcessId.KERNEL32(00000000), ref: 0022AF38
CloseHandle.KERNEL32(00000000), ref: 0022AF67

Strings

@, xrefs: 0022AE72
<, xrefs: 0022AE6B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 425b988274e20eef1ea244cea6b118f593e4692a933c2e42d857c87097c389a0
Instruction ID: b01eeed7aedbd12f89e509c61e81fd7c4d9544cb96a52e4bebfda7b708510eb8
Opcode Fuzzy Hash: 425b988274e20eef1ea244cea6b118f593e4692a933c2e42d857c87097c389a0
Instruction Fuzzy Hash: B571B075A00625DFCB14EF94E484A9EBBF0FF09300F058499E816AB792CB75EE45CB91

Function 0020719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00207206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0020723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0020724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002072CF

Strings

DllGetClassObject, xrefs: 00207242

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: fa2085cc18e5ca3a493207d2965a7b155e6e3b5c4914c468e8f82b96128d454b
Instruction ID: cff7d5e6327d6da0aeb2731db8667e892ef32faaea29d6bde0d6bca17bc418b3
Opcode Fuzzy Hash: fa2085cc18e5ca3a493207d2965a7b155e6e3b5c4914c468e8f82b96128d454b
Instruction Fuzzy Hash: 7C4181B1A14304EFDB15CF54C884A9A7BB9EF44310F2580A9BD059F28BD7B0ED54DBA0

Function 00233D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00233E35
IsMenu.USER32(?), ref: 00233E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00233E92
DrawMenuBar.USER32 ref: 00233EA5

Strings

0, xrefs: 00233D89

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 8e080cf60d6982e14e82c956560886ed58da997053d82f802be50594ca218c77
Instruction ID: 1f94b4d698b3bc53b4b7834ed82923971736c9dc933fe77c824def3ba3dcfa0d
Opcode Fuzzy Hash: 8e080cf60d6982e14e82c956560886ed58da997053d82f802be50594ca218c77
Instruction Fuzzy Hash: F44148B5A2020AEFDB10DF54E884EEABBB9FF49350F144129E905A7250D730EE65CF60

Function 00201DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00201E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00201E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00201EA9

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Strings

ListBox, xrefs: 00201E25
ComboBox, xrefs: 00201DF0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 93608799807b777031ba21fa690a59db9413d0c6d6ecf892fe0344098253ea74
Instruction ID: efafd1da5545951ff6719dfa60fe32d3f3f6f9e32e344211e1e26c7943a7205a
Opcode Fuzzy Hash: 93608799807b777031ba21fa690a59db9413d0c6d6ecf892fe0344098253ea74
Instruction Fuzzy Hash: DB213575A10204BBDB18AF60DC46CFFB7B8EF56360B144119F821A71E2DB34496A8A20

Function 0022C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0022C9F1
_wcslen.LIBCMT ref: 0022CA68
_wcslen.LIBCMT ref: 0022CA9E
_wcslen.LIBCMT ref: 0022CAF9
_wcslen.LIBCMT ref: 0022CB2F
_wcslen.LIBCMT ref: 0022CB7F

Strings

HKLM, xrefs: 0022CA98, 0022CA9D
HKEY_LOCAL_MACHINE, xrefs: 0022CA62, 0022CA67

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 60a312a7dabde5f821bda7e91b7cb3323e220cdc855298d965d761e8b5a72514
Instruction ID: 1cafd9d01dfe6f38019e120be624cb91398f09064c1472f34e46ca3a9bef436c
Opcode Fuzzy Hash: 60a312a7dabde5f821bda7e91b7cb3323e220cdc855298d965d761e8b5a72514
Instruction Fuzzy Hash: 67310973A2017B5BCB20DFACF8505BE33919B71794B254029E8456B344EB71CEA0D3A0

Function 00232F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00232F8D
LoadLibraryW.KERNEL32(?), ref: 00232F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00232FA9
DestroyWindow.USER32(?), ref: 00232FB1

Strings

SysAnimate32, xrefs: 00232F68

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 0974d27eb9b6fb743b83c9005612271c5189f90724939bc08f701c8ddcc96ba9
Instruction ID: c939a3de12da1e1c8baa35ff0fdd55c3d2671c07f31e2166105443c0f9894322
Opcode Fuzzy Hash: 0974d27eb9b6fb743b83c9005612271c5189f90724939bc08f701c8ddcc96ba9
Instruction Fuzzy Hash: 3F21CDB2224206EBEB104F64EC85EBB77BDEF59364F100218FA50E2590D771DCA59B60

Function 001C4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,001C4D1E,001D28E9,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002), ref: 001C4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001C4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,001C4D1E,001D28E9,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002,00000000), ref: 001C4DC3

Strings

mscoree.dll, xrefs: 001C4D86
CorExitProcess, xrefs: 001C4D98

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b34d5455fda882498f38e166d4ad8841efe6d31c8f18cc0ed650bfd19ec3cd82
Instruction ID: 36a9b1f7debd209ec17133ef2d55f01dd6b130ffccd830ee87bafaff88280850
Opcode Fuzzy Hash: b34d5455fda882498f38e166d4ad8841efe6d31c8f18cc0ed650bfd19ec3cd82
Instruction Fuzzy Hash: ABF04F35A40208BBDB15AF90EC4DFADBBB5EF54751F1001A8F90AA2660CB709A90DB91

Function 001FD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 001FD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 001FD3BF
FreeLibrary.KERNEL32(00000000), ref: 001FD3E5

Strings

X64, xrefs: 001FD2A8
GetSystemWow64DirectoryW, xrefs: 001FD3B9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: e410f3cbb13f08b82f6f89e6918dababf504ccf84e296ce56ef1e2fac03030f1
Instruction ID: 68b4eb46fd10523502a08296cb3758d6fad8d25ead091a751c09daaa43c0e964
Opcode Fuzzy Hash: e410f3cbb13f08b82f6f89e6918dababf504ccf84e296ce56ef1e2fac03030f1
Instruction Fuzzy Hash: 68F055B2805A289BE7385710FC489793325BF11B01B668098F74BF2018DB30CC40A7C3

Function 001A4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001A4EAE
FreeLibrary.KERNEL32(00000000,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 001A4EA8
kernel32.dll, xrefs: 001A4E94

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: d74874ad28d0c8c808665a8c3f7b89d7e5166e8684256286c0628f09a1c0993d
Instruction ID: e0f266b68924e02f1f4ec489d4be78b4a62e46cc983e1cb6106e9ffd69f2d86d
Opcode Fuzzy Hash: d74874ad28d0c8c808665a8c3f7b89d7e5166e8684256286c0628f09a1c0993d
Instruction Fuzzy Hash: 9BE0863AA015225BD22117257C1CA6BA564AFC3F62B150115FC05F2100DBA4CD0152F4

Function 001A4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001A4E74
FreeLibrary.KERNEL32(00000000,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E87

Strings

kernel32.dll, xrefs: 001A4E5B
Wow64RevertWow64FsRedirection, xrefs: 001A4E6E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 8dbc6ab1ef3f2daa0d4fdb7ee33798887d5b46916ab607da864098fece0b433c
Instruction ID: d3d62adc163a4294e40b25a3988d905d24b205a209d7271d200f25987ebc2dc7
Opcode Fuzzy Hash: 8dbc6ab1ef3f2daa0d4fdb7ee33798887d5b46916ab607da864098fece0b433c
Instruction Fuzzy Hash: 24D0C23A50262157A6231B247C0CD8B6A28AFC7F113150111B809F2110CFA4CD0192E0

Function 00212947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00212C05
DeleteFileW.KERNEL32(?), ref: 00212C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00212C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00212CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00212CC0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 8bc11c3e67d7338b87050bf076a957c10e5103a1f2271c5d1413a5414aea4c20
Instruction ID: a265dcb9f738436db63ae954700cf569156ea0900b379f2a986543d1a340e40d
Opcode Fuzzy Hash: 8bc11c3e67d7338b87050bf076a957c10e5103a1f2271c5d1413a5414aea4c20
Instruction Fuzzy Hash: CDB16171D10119ABDF21DFA4CD85EDEB7BDEF29350F1040A6F609E6141EB309A988FA1

Function 0022A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0022A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0022A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0022A468
CloseHandle.KERNEL32(?), ref: 0022A63D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 19fabf232f018c8317870d42f318b1d266afa6a74a32d09d1282bc75612c3886
Instruction ID: 560b074a98ba624fb04ef1852c2746067ad3b6e9eb2a2049d416e7874b91aeb3
Opcode Fuzzy Hash: 19fabf232f018c8317870d42f318b1d266afa6a74a32d09d1282bc75612c3886
Instruction Fuzzy Hash: 87A1C075604301AFD720EF28D886F2AB7E5AF98714F14885CF55A9B6D2D7B0EC41CB82

Function 0020E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0020CF22,?), ref: 0020DDFD

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0020CF22,?), ref: 0020DE16

Part of subcall function 0020E199: GetFileAttributesW.KERNEL32(?,0020CF95), ref: 0020E19A

lstrcmpiW.KERNEL32(?,?), ref: 0020E473
MoveFileW.KERNEL32(?,?), ref: 0020E4AC
_wcslen.LIBCMT ref: 0020E5EB
_wcslen.LIBCMT ref: 0020E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0020E650

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: b34f928606a09c9e1ee06210dbb017698e572af9abb3dae8495c6a13f98a95ad
Instruction ID: e42a43c889cc15606dbede5d34d3af5be536725d3607e202708f7af4b5edd668
Opcode Fuzzy Hash: b34f928606a09c9e1ee06210dbb017698e572af9abb3dae8495c6a13f98a95ad
Instruction Fuzzy Hash: 025172B24183455BCB24EB90DC819DBB3ECAF95340F00491EF68993192EF75E6988B66

Function 0022B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0022BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0022BB63
RegCloseKey.ADVAPI32(?,?), ref: 0022BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0022BBB3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6ae2438eb7b16599e2545c1b93606cf7b3ccf41a720a1e294098061a55be76dd
Instruction ID: b85515594564b92e6c31b95e9f462c10ac5431d5573795d04b3180bb48736bbe
Opcode Fuzzy Hash: 6ae2438eb7b16599e2545c1b93606cf7b3ccf41a720a1e294098061a55be76dd
Instruction Fuzzy Hash: 8061C135218241BFC715DF54D490E2ABBE5FF85308F54895CF4998B2A2CB31ED45CB92

Function 00208BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00208BCD
VariantClear.OLEAUT32 ref: 00208C3E
VariantClear.OLEAUT32 ref: 00208C9D
VariantClear.OLEAUT32(?), ref: 00208D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00208D3B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 80a3c758ca95b5bb180220e574723ce30d143d37f925fbb54234675a2cf8df70
Instruction ID: f4bcf4e14f8bccb2ebbffbd410d28503a3840bcceca1bf7122c0dc73573bca40
Opcode Fuzzy Hash: 80a3c758ca95b5bb180220e574723ce30d143d37f925fbb54234675a2cf8df70
Instruction Fuzzy Hash: A6516AB5A10219EFDB14CF68D884AAAB7F8FF89310B158569E945DB350E730E921CF90

Function 00218AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00218BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00218BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00218C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00218C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00218C5F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 97f52026f9c78927c0225a11041a9a3070062cd89a0e5066a9c42c4d7676b658
Instruction ID: 057aab9410cd998c8010f668f5a154baa8dfe565550e57ef4ea1d94d66fead94
Opcode Fuzzy Hash: 97f52026f9c78927c0225a11041a9a3070062cd89a0e5066a9c42c4d7676b658
Instruction Fuzzy Hash: 47515A39A00215DFCB05DF64C881AAEBBF5FF59314F088059E849AB3A2CB31ED51CB90

Function 00228EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00228F40
GetProcAddress.KERNEL32(00000000,?), ref: 00228FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00228FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00229032
FreeLibrary.KERNEL32(00000000), ref: 00229052

Part of subcall function 001BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00211043,?,753CE610), ref: 001BF6E6
Part of subcall function 001BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,001FFA64,00000000,00000000,?,?,00211043,?,753CE610,?,001FFA64), ref: 001BF70D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 76c15a7479de7d2f6213b5ebd8ad91adc6950b8eb9983c54ea490852c3154567
Instruction ID: 0320dc452213ca5eff054a3a2a60d8b3ad7377df670dd78f4a8663342e96e223
Opcode Fuzzy Hash: 76c15a7479de7d2f6213b5ebd8ad91adc6950b8eb9983c54ea490852c3154567
Instruction Fuzzy Hash: 04518E38A05215EFC701DF94D4948ADBBF1FF59314F588098E809AB762DB31EE85CB90

Function 00236B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00236C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00236C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00236C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0021AB79,00000000,00000000), ref: 00236C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00236CC7

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: b4914faaed94966b2513a81143e6e073ac576e738d50627a4eea5fb961e69474
Instruction ID: a6f1f71f1af0a96827e0900fbc90185847dc2f01932c2b48b09b771528a0a8db
Opcode Fuzzy Hash: b4914faaed94966b2513a81143e6e073ac576e738d50627a4eea5fb961e69474
Instruction Fuzzy Hash: 19410AB5620105BFDB24CF28CC5DFA9BBADEB09350F149625F855A72E0C371ED61CA50

Function 001D2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001D20C3
_free.LIBCMT ref: 001D20E3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2f4b9782920c3b29c482850540d5a061ed05fdcb2ac29f1190665a254ffb4a67
Instruction ID: fd607fca82cc57c255278bea8f97b200a970c39e799da584398b14040bf83654
Opcode Fuzzy Hash: 2f4b9782920c3b29c482850540d5a061ed05fdcb2ac29f1190665a254ffb4a67
Instruction Fuzzy Hash: 9541D732A00200AFCB24DF78C881A6DB7F5EFA9314F1585AAE525EB351D731ED01DB80

Function 001B912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001B9141
ScreenToClient.USER32(00000000,?), ref: 001B915E
GetAsyncKeyState.USER32(00000001), ref: 001B9183
GetAsyncKeyState.USER32(00000002), ref: 001B919D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: eca2f111e2eaf0a562552f9226068d6e86647af14f7f37fd70144d4d5e7d0ac7
Instruction ID: 38a77112b5512a55103b56cd633854da76274e484d71f5c8e5787d6d8dc32bc9
Opcode Fuzzy Hash: eca2f111e2eaf0a562552f9226068d6e86647af14f7f37fd70144d4d5e7d0ac7
Instruction Fuzzy Hash: 6B415C71A0860AFBDF199F68C848BFEB774FF05320F21821AE529A62D0C7346955DF91

Function 00213874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 002138CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00213922
TranslateMessage.USER32(?), ref: 0021394B
DispatchMessageW.USER32(?), ref: 00213955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00213966

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 677225ce0522ab4c958d38fb9a3281f47e1666fb920baf6939fe5b112aa55018
Instruction ID: 9757f6d2e990ea62893840028df08ee4947d43ae5d4209eb78975cf97b9c8ace
Opcode Fuzzy Hash: 677225ce0522ab4c958d38fb9a3281f47e1666fb920baf6939fe5b112aa55018
Instruction Fuzzy Hash: E231C470924346DEEB35CF34A84DBF63BE9AF25300F140569E466921A0E3F4AAE5CB51

Function 0021CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0021CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0021CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0021C21E,00000000), ref: 0021CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0021C21E,00000000), ref: 0021CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0021C21E,00000000), ref: 0021CFF2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 20b9e054b8e243e21f4c4d535bf39854e7025577bb0725da740f826f05c3fa70
Instruction ID: 5e85f0f4ec35d812dc63aa1d354c0f003e65a05c1936e100f817179066a1ef87
Opcode Fuzzy Hash: 20b9e054b8e243e21f4c4d535bf39854e7025577bb0725da740f826f05c3fa70
Instruction Fuzzy Hash: 7E318075550206EFDB20DFA5D888AEBBBF9EB24310B20442FF516E2550D730ED92DB60

Function 00201901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00201915
PostMessageW.USER32(00000001,00000201,00000001), ref: 002019C1
Sleep.KERNEL32(00000000,?,?,?), ref: 002019C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 002019DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 002019E2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1796172c52ea422dae11f339635670b2ff1039b9c99f7cd717f468f0d22e9f5c
Instruction ID: 655714171dd787722a2ce9f495daaf4834c4d36187dce7295ed215eef8f599cd
Opcode Fuzzy Hash: 1796172c52ea422dae11f339635670b2ff1039b9c99f7cd717f468f0d22e9f5c
Instruction Fuzzy Hash: E831E071A1021EEFCB04CFA8DD9DADE3BB5EB44314F104229F921A72D2C3B09964CB90

Function 00235706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00235745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0023579D
_wcslen.LIBCMT ref: 002357AF
_wcslen.LIBCMT ref: 002357BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00235816

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: ac9e86d018798dd31c1b258c501ebf8b4386e38207aa7d8dea686a1eb680dcb1
Instruction ID: 193f765b59526d707344e5dda6520abbc99fad7457fe233216717cb6a4050ed2
Opcode Fuzzy Hash: ac9e86d018798dd31c1b258c501ebf8b4386e38207aa7d8dea686a1eb680dcb1
Instruction Fuzzy Hash: 2421A5B19246299BDB208F64DC85AEDB7B8FF54324F108216F91DEA180D7708995CF50

Function 00220930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00220951
GetForegroundWindow.USER32 ref: 00220968
GetDC.USER32(00000000), ref: 002209A4
GetPixel.GDI32(00000000,?,00000003), ref: 002209B0
ReleaseDC.USER32(00000000,00000003), ref: 002209E8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5d1428f0a53138da5b5075d7b5e5c900988ce24b74a9d3c98b024d8c6a15d12d
Instruction ID: e5753093466cd96fca9c76d985469072f7bbd05471e5357e85d05a9beff42d7f
Opcode Fuzzy Hash: 5d1428f0a53138da5b5075d7b5e5c900988ce24b74a9d3c98b024d8c6a15d12d
Instruction Fuzzy Hash: B6218435A00214AFD714EFA5D889A9EB7F9EF55700F148068E84AA7762CB70EC54CF50

Function 001DCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001DCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001DCDE9

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 001DCE0F
_free.LIBCMT ref: 001DCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001DCE31

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 0be0cfe37f8b22760710d3b0b7b44a21621739d01e434f0c58e04ebdb60de689
Instruction ID: 61ba7c9b729af3b5117948e3850b1574a109df404e0cc415c6aa7b8d0ec71e7c
Opcode Fuzzy Hash: 0be0cfe37f8b22760710d3b0b7b44a21621739d01e434f0c58e04ebdb60de689
Instruction Fuzzy Hash: 600184B26016167F672116BA6C8CD7BBE6EDEC6BA1325062BF905D7301EB618D01D2F0

Function 001B9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001B9693
SelectObject.GDI32(?,00000000), ref: 001B96A2
BeginPath.GDI32(?), ref: 001B96B9
SelectObject.GDI32(?,00000000), ref: 001B96E2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b066466bba3630b32dfe1fdf5277a8a7032d40636c470d05f17d6c524c1d1f6d
Instruction ID: b968e937447d6b359189fa1bb06748dc0673b91325b454cdcb50a4a011568078
Opcode Fuzzy Hash: b066466bba3630b32dfe1fdf5277a8a7032d40636c470d05f17d6c524c1d1f6d
Instruction Fuzzy Hash: FE216A71802246EBDB119F28FC1DBE97BA8BF10325F200216F618A61A0D37098A3CF90

Function 00205711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00205726
_memcmp.LIBVCRUNTIME ref: 00205744
_memcmp.LIBVCRUNTIME ref: 00205757
_memcmp.LIBVCRUNTIME ref: 0020576F
_memcmp.LIBVCRUNTIME ref: 00205787

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1953a0aa27470cf6eba7d1b540385bc430d9840e90dbb19813d385a35e94c553
Instruction ID: 4d24627fee12163f22491f03a95ad6ed4095490ce11cfc734a12da24b53cbdf5
Opcode Fuzzy Hash: 1953a0aa27470cf6eba7d1b540385bc430d9840e90dbb19813d385a35e94c553
Instruction Fuzzy Hash: 8801F9A16E1755BBD70895109F82FBBB35DAF323A8F000025FD049A2C3F760ED3096A1

Function 001D2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,001CF2DE,001D3863,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6), ref: 001D2DFD
_free.LIBCMT ref: 001D2E32
_free.LIBCMT ref: 001D2E59
SetLastError.KERNEL32(00000000,001A1129), ref: 001D2E66
SetLastError.KERNEL32(00000000,001A1129), ref: 001D2E6F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9c98e46be4fadb9821f6186570d5375bda1f94be9ba6f750e800daa8bee4ea53
Instruction ID: 2a7d7048c7a45d24607a4b141628a43c7e5217e019164fb3639884db7302dc81
Opcode Fuzzy Hash: 9c98e46be4fadb9821f6186570d5375bda1f94be9ba6f750e800daa8bee4ea53
Instruction Fuzzy Hash: AC0128326056006BC62677347C49D2B275EABF23B6B35442BF435A33D2EFB0CC019120

Function 0020000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?,?,0020035E), ref: 0020002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?), ref: 00200064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200070

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0d1b65a42a2be4f3401555376eabe38134db486d700dbb899e788db84130fde9
Instruction ID: 7e0513212cbc1d1ab24101fddde065acf1fc5bd162cc18bd5b7c62a3555d9fc5
Opcode Fuzzy Hash: 0d1b65a42a2be4f3401555376eabe38134db486d700dbb899e788db84130fde9
Instruction Fuzzy Hash: 3301A276610315BFEB114F68EC88BAA7AEEEF44751F244124F905E2251DB71DE508BA0

Function 002010F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00201114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 0020112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0020114D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b62dd152896e35463ec1bc9e6d030ce39da524ad95be01fddc4ce3d829abe654
Instruction ID: b24ce3c6023877a0278d913de4fdbc8cde380e48188e545aabb51907c82e06b5
Opcode Fuzzy Hash: b62dd152896e35463ec1bc9e6d030ce39da524ad95be01fddc4ce3d829abe654
Instruction Fuzzy Hash: 89011975200315BFDB154FA5EC4DA6A7B6EEF893A0B204429FA49E73A0DA31DC109B60

Function 00200FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00200FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00200FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00200FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00200FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00201002

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 25681e8ea185f24c28253d5a6183d915c387617e8df92c5c3283f951bebfad49
Instruction ID: d3d6ffa4e5dec83a6b2c43578d41230f1c99740f189750678924c46ed0a2825b
Opcode Fuzzy Hash: 25681e8ea185f24c28253d5a6183d915c387617e8df92c5c3283f951bebfad49
Instruction Fuzzy Hash: B2F06235200311EBD7215FA4EC4DF563B6EEF89761F204414FD89D7291CA70DC608B60

Function 00201014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0020102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00201036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0020104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201062

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 085630055e7df8f39ec7a87cb22a7eba0769445a3d0362fef93bcbc0497b3900
Instruction ID: bd2c12466e45fa45abd3aef0d30abf8d82a0a135539db5cc3a5da0b748038cf9
Opcode Fuzzy Hash: 085630055e7df8f39ec7a87cb22a7eba0769445a3d0362fef93bcbc0497b3900
Instruction Fuzzy Hash: 09F06D35200312EBDB215FA4EC4DF563BAEEF89761F200424FE89E7291CA70D8608B60

Function 0021030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210324
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210331
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 0021033E
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 0021034B
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210358
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210365

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 42bb6236cfc8a32ab0303135b5ae1e61bda5ca2f3d208aced64eb064ed571f9f
Instruction ID: ebc2576f87960d96bbe6401a3a190a21a616d767f4eb78d1a7f0de1229ac023e
Opcode Fuzzy Hash: 42bb6236cfc8a32ab0303135b5ae1e61bda5ca2f3d208aced64eb064ed571f9f
Instruction Fuzzy Hash: C301A272810B169FC730AF66D8C0456F7F5BF603153158A7FD1A652931C3B1A9A5DF80

Function 001DD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001DD752

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DD764
_free.LIBCMT ref: 001DD776
_free.LIBCMT ref: 001DD788
_free.LIBCMT ref: 001DD79A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9973e0b073f01a3d1d57781fbf986f91ae2c388cee4feeb9e859d1dfa34e0c62
Instruction ID: 710f23c6bd13da9e4a8eca1fb5dde9b8bb68627ba0a8653394babb5aac9e62e5
Opcode Fuzzy Hash: 9973e0b073f01a3d1d57781fbf986f91ae2c388cee4feeb9e859d1dfa34e0c62
Instruction Fuzzy Hash: C8F09632541214AB8725FB64F9C6C2677DDBB54318BA44C47F0A8D7701C734FC808A60

Function 00205C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00205C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00205C6F
MessageBeep.USER32(00000000), ref: 00205C87
KillTimer.USER32(?,0000040A), ref: 00205CA3
EndDialog.USER32(?,00000001), ref: 00205CBD

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ba4b90a4933b9d217b62c756fc3dee0833b448bf2590f6888577b3a0e27ce131
Instruction ID: f632a91a95dfc7740d0012a80edb264925bbfe36a55bfd0bd2a087fbb0909726
Opcode Fuzzy Hash: ba4b90a4933b9d217b62c756fc3dee0833b448bf2590f6888577b3a0e27ce131
Instruction Fuzzy Hash: 13016231510B14ABFB215B10ED4FFA67BBCBB00B05F04155AA583B14E1DBF4A9958F90

Function 001D22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001D22BE

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001D22D0
_free.LIBCMT ref: 001D22E3
_free.LIBCMT ref: 001D22F4
_free.LIBCMT ref: 001D2305

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9c1f45f0a31e73241a24ed8ce56702eb5f6c5cafc8e90ec131fcb3754cbd695f
Instruction ID: 7b09dbae83218c4ea63318b889a9ce07ea251267223c2bf89315b765ee2204c8
Opcode Fuzzy Hash: 9c1f45f0a31e73241a24ed8ce56702eb5f6c5cafc8e90ec131fcb3754cbd695f
Instruction Fuzzy Hash: 46F03AB08101308B8626BF68BC598183B68BB38760710050BF828D33B2CB7008A1BBE5

Function 001B95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 001B95D4
StrokeAndFillPath.GDI32(?,?,001F71F7,00000000,?,?,?), ref: 001B95F0
SelectObject.GDI32(?,00000000), ref: 001B9603
DeleteObject.GDI32 ref: 001B9616
StrokePath.GDI32(?), ref: 001B9631

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a043b69e04511fa1f89761f3cbfea4810a0ce6cce7c281a4a025f7a50762dffe
Instruction ID: ee00e79f48537a9462d8ce7bea5602fee1dc73c0c22527ae732270adbe3ad025
Opcode Fuzzy Hash: a043b69e04511fa1f89761f3cbfea4810a0ce6cce7c281a4a025f7a50762dffe
Instruction Fuzzy Hash: 7AF0E731006288EBDB265F69FD1CBA43F65AF01322F148214F669690F0C73189A7DF20

Function 001D0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 001D10F9
__freea.LIBCMT ref: 001D1117

Part of subcall function 001D1537: _free.LIBCMT ref: 001D154F

Strings

am/pm, xrefs: 001D117A
a/p, xrefs: 001D11DE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 72b631817deb138def9e9f6df038a26a1a9651d93d57c2c11ff38600b05e6930
Instruction ID: bb47504cd57436ccc7293871a1514480bf5d840cb0aa8dc69ac2be9db3b36cce
Opcode Fuzzy Hash: 72b631817deb138def9e9f6df038a26a1a9651d93d57c2c11ff38600b05e6930
Instruction Fuzzy Hash: 53D10331900206FADB289F68C895BFEB7B1FF16320F29415BE901AB751D3759D80CB91

Function 002261D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 001C0242: EnterCriticalSection.KERNEL32(0027070C,00271884,?,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C024D
Part of subcall function 001C0242: LeaveCriticalSection.KERNEL32(0027070C,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C028A

Part of subcall function 001C00A3: __onexit.LIBCMT ref: 001C00A9

__Init_thread_footer.LIBCMT ref: 00226238

Part of subcall function 001C01F8: EnterCriticalSection.KERNEL32(0027070C,?,?,001B8747,00272514), ref: 001C0202
Part of subcall function 001C01F8: LeaveCriticalSection.KERNEL32(0027070C,?,001B8747,00272514), ref: 001C0235

Part of subcall function 0021359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002135E4
Part of subcall function 0021359C: LoadStringW.USER32(00272390,?,00000FFF,?), ref: 0021360A

Strings

x#', xrefs: 0022633A
x#', xrefs: 0022636F
x#', xrefs: 00226353

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#'$x#'$x#'
API String ID: 1072379062-1408229380
Opcode ID: c8f6c605b63295417c5251ac7ad822ad2944554a694ef1d3759d104533e6c2ec
Instruction ID: 37defcdb6f2b3eed2d542c3d26f07fd609b7f0ae49c34a90104b25a466c8fc26
Opcode Fuzzy Hash: c8f6c605b63295417c5251ac7ad822ad2944554a694ef1d3759d104533e6c2ec
Instruction Fuzzy Hash: B0C1BD72A10116AFCB24DF98D894EBEB7B9EF58300F108069F9459B291DB70ED64CB90

Function 00227B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 001C0242: EnterCriticalSection.KERNEL32(0027070C,00271884,?,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C024D
Part of subcall function 001C0242: LeaveCriticalSection.KERNEL32(0027070C,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C028A

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 001C00A3: __onexit.LIBCMT ref: 001C00A9

__Init_thread_footer.LIBCMT ref: 00227BFB

Part of subcall function 001C01F8: EnterCriticalSection.KERNEL32(0027070C,?,?,001B8747,00272514), ref: 001C0202
Part of subcall function 001C01F8: LeaveCriticalSection.KERNEL32(0027070C,?,001B8747,00272514), ref: 001C0235

Strings

5, xrefs: 00227C78
G, xrefs: 00227C7F
Variable must be of type 'Object'., xrefs: 00227C3A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: e93060ca01d29e3f330716fb2d8b4e9028a49468e7ade66d59a1469711109cfc
Instruction ID: 3df461791bb7fece8c859f4060fa531ee47eb21ee15d4985fcfd3798fe9fcf10
Opcode Fuzzy Hash: e93060ca01d29e3f330716fb2d8b4e9028a49468e7ade66d59a1469711109cfc
Instruction Fuzzy Hash: AF91A074628219EFCB14EF94E891DBDB7B1FF49300F508059F8066B292DB71AE61CB51

Function 00202716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0020B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002021D0,?,?,00000034,00000800,?,00000034), ref: 0020B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00202760

Part of subcall function 0020B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002021FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0020B3F8

Part of subcall function 0020B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0020B355
Part of subcall function 0020B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00202194,00000034,?,?,00001004,00000000,00000000), ref: 0020B365
Part of subcall function 0020B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00202194,00000034,?,?,00001004,00000000,00000000), ref: 0020B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002027CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0020281A

Strings

@, xrefs: 00202832

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 7637ae7631afa3a947469d8f00a0b813204ffbde91b57e41e9ed4433c13de18e
Instruction ID: 6f8a86957e02fcc8dbff2c0e5c08dacff05c961a078e79038875eac145242aab
Opcode Fuzzy Hash: 7637ae7631afa3a947469d8f00a0b813204ffbde91b57e41e9ed4433c13de18e
Instruction Fuzzy Hash: 41413C76900218AFDB11DFA4CD46AEEBBB8AF09300F108095FA55B7191DB706E59CFA0

Function 001D172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 001D1769
_free.LIBCMT ref: 001D1834
_free.LIBCMT ref: 001D183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 001D1760, 001D1767, 001D1796, 001D17CE

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 051281f51a06f215a540411fd86acdcbea80795da60a7420d5a2339dd0ae9851
Instruction ID: 08942029d0fa2b9cc8a9bdff37051a776458a7ab11b99cc757c2b370e8b1366c
Opcode Fuzzy Hash: 051281f51a06f215a540411fd86acdcbea80795da60a7420d5a2339dd0ae9851
Instruction Fuzzy Hash: 0C318D71A40258BBDB21DB99D885D9EBBFCEFA5310B1041ABF804D7321D7708E80DBA0

Function 0020C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0020C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0020C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00271990,01595CB8), ref: 0020C395

Strings

0, xrefs: 0020C2DF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 5ad55728a38764e67169c0d5e2ba1021ab040a9425ea73cd481db62217446dce
Instruction ID: 66157674c898812fd9a2d8225b1cffa6740c8d6c0b88ff4c2216b2c2a4d452ed
Opcode Fuzzy Hash: 5ad55728a38764e67169c0d5e2ba1021ab040a9425ea73cd481db62217446dce
Instruction Fuzzy Hash: EE41B2B12243029FD720DF24D884B5ABBE4AF85310F20876DF8A5972D2D770E954CB62

Function 00234416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0023CC08,00000000,?,?,?,?), ref: 002344AA
GetWindowLongW.USER32 ref: 002344C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002344D7

Strings

SysTreeView32, xrefs: 0023447C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 3dff4296c54616e74b87f008258d86a98ddb379dc43ae00491a18d1e3e08111f
Instruction ID: d40fe634c098aaa47d184cdecce3d7d2227a30d564a52447b4f83edd5f0d4819
Opcode Fuzzy Hash: 3dff4296c54616e74b87f008258d86a98ddb379dc43ae00491a18d1e3e08111f
Instruction Fuzzy Hash: E4319072220206AFDB20AE38DC45BDA77A9EF19334F204725FA75A21D0D770EC619B50

Function 00206E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00206EED
VariantCopyInd.OLEAUT32(?,?), ref: 00206F08
VariantClear.OLEAUT32(?), ref: 00206F12

Strings

*j , xrefs: 00206E8B, 00206E90, 00206EF8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j
API String ID: 2173805711-1860680129
Opcode ID: eb87216ed0488e9562718cb99c4c3d8503b1a129ac914a9365a50e0e7fe873b4
Instruction ID: 6cb30cd228519de843451cbca5b724e83a9367ef673a35e16f9c22b6b72a9aab
Opcode Fuzzy Hash: eb87216ed0488e9562718cb99c4c3d8503b1a129ac914a9365a50e0e7fe873b4
Instruction Fuzzy Hash: 6A317075618346DFCB05AFA4E8999BD3776FF55700B2004A8F9034BAE2C7749932DB90

Function 0022304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0022335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00223077,?,?), ref: 00223378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0022307A
_wcslen.LIBCMT ref: 0022309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00223106

Strings

255.255.255.255, xrefs: 00223095, 0022309A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 9c1153835fb874d178e0ddf469b27f285cc61e1d93c0295a1e28b0dadaf3a761
Instruction ID: 7936915b77fa47dce4ecc334ba8bddc17f8ec591f5528eb8bedac92255bfb2d1
Opcode Fuzzy Hash: 9c1153835fb874d178e0ddf469b27f285cc61e1d93c0295a1e28b0dadaf3a761
Instruction Fuzzy Hash: A131D539214226AFCB10CFA8E485EA977E0EF15318F248059E9158B392DB7ADF55CB70

Function 00233EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00233F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00233F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00233F78

Strings

SysMonthCal32, xrefs: 00233F0B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9c63a17a88e85ad74d62f8d1536b4b68c566e2437c08b90058cad5dcc54542f2
Instruction ID: c4454be180c6832c3a0235de6d8144bb82a69ef12a733be7966c685f87039cc7
Opcode Fuzzy Hash: 9c63a17a88e85ad74d62f8d1536b4b68c566e2437c08b90058cad5dcc54542f2
Instruction Fuzzy Hash: D021BF72620219BBDF25CF50DC46FEA3B79EF88724F110214FA156B1D0D6B1A9A08B90

Function 00234653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00234705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00234713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0023471A

Strings

msctls_updown32, xrefs: 00234684

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: e11a84eb13b1a513b0bd2135b9420d26d5741698824d37bea6e7319b282324e9
Instruction ID: f32701a59ade90605ddb85a5e2f5b8e46f5b5452e2e16687d4d508354390bb72
Opcode Fuzzy Hash: e11a84eb13b1a513b0bd2135b9420d26d5741698824d37bea6e7319b282324e9
Instruction Fuzzy Hash: DC215EB5610209AFDB10EF68EC95DA777ADEF5A3A4B140059FA049B251CB70FC62CB60

Function 002095AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0020961D

Strings

#OnAutoItStartRegister, xrefs: 002095F3
#notrayicon, xrefs: 002095B7
#requireadmin, xrefs: 002095D9

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: f9316c0c871cbdcc6a6aee7e94851c0851a4af3b3afdd21a119ec28248bd36d5
Instruction ID: 379c3fd5d7ad1c2a3bc3f11b278ff81640522ece0b2925356c11c5ffa4d57a41
Opcode Fuzzy Hash: f9316c0c871cbdcc6a6aee7e94851c0851a4af3b3afdd21a119ec28248bd36d5
Instruction Fuzzy Hash: 0A210B7212471266D331AE259C02FB7779C9F75310F544029F94B971C3EB91DDA1C295

Function 002337B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00233840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00233850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00233876

Strings

Listbox, xrefs: 0023380F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a656845efc735b6214166b4fa9a5e2116263c06a1a2bc33c1d5b97c8f1d80f57
Instruction ID: 5ab75f3f3284a7bea0e0b3fb0508979844a83231374fbd9df698e32dea861af8
Opcode Fuzzy Hash: a656845efc735b6214166b4fa9a5e2116263c06a1a2bc33c1d5b97c8f1d80f57
Instruction Fuzzy Hash: E321A4B2620219BBEF21CF54DC45FBB776EEF89764F118114F9049B190C671DD628BA0

Function 002149F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00214A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00214A5C
SetErrorMode.KERNEL32(00000000,?,?,0023CC08), ref: 00214AD0

Strings

%lu, xrefs: 00214A6F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 9bf397b744a76c587b9c4f15c5ee8f8fb242be541aca1578f99ea0bea0cd814d
Instruction ID: 97cba1810d43f02f4803aa35cdb35929f561aecdb40fd7de82599b0cc64c0c7a
Opcode Fuzzy Hash: 9bf397b744a76c587b9c4f15c5ee8f8fb242be541aca1578f99ea0bea0cd814d
Instruction Fuzzy Hash: E5318575A00109AFD710DF54C885EAE7BF8EF09314F1480A5F909DB252D771EE85CBA1

Function 002341EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0023424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00234264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00234271

Strings

msctls_trackbar32, xrefs: 00234226

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: c16510d7954907c2587c481b1bc56d32c92e6c72f0d4f3ac53babf9feafae003
Instruction ID: 3af2585345038cb33d6d55e99a772ef0420a2d1d15ab54e2b2cdf59974c6ddf8
Opcode Fuzzy Hash: c16510d7954907c2587c481b1bc56d32c92e6c72f0d4f3ac53babf9feafae003
Instruction Fuzzy Hash: 35110671250208BFEF206F29DC06FAB3BACEF95B64F110114FA55E60A0D271EC619B10

Function 00202F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Part of subcall function 00202DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00202DC5
Part of subcall function 00202DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00202DD6
Part of subcall function 00202DA7: GetCurrentThreadId.KERNEL32 ref: 00202DDD
Part of subcall function 00202DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00202DE4

GetFocus.USER32 ref: 00202F78

Part of subcall function 00202DEE: GetParent.USER32(00000000), ref: 00202DF9

GetClassNameW.USER32(?,?,00000100), ref: 00202FC3
EnumChildWindows.USER32(?,0020303B), ref: 00202FEB

Strings

%s%d, xrefs: 00202FFF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 906196ec9809599bce58068a9778a1ab0c258e9ec5a53f8b3f0a46ae2d2ccf01
Instruction ID: 4aa91fb1dc6986570c4fe1a11476a5c2d23643529415fd2364766405e352463c
Opcode Fuzzy Hash: 906196ec9809599bce58068a9778a1ab0c258e9ec5a53f8b3f0a46ae2d2ccf01
Instruction Fuzzy Hash: 9311AC75310305ABCF01AF709C8AAEE776EAF95304F044076B909AB293DE3099598F60

Function 00235882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002358C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002358EE
DrawMenuBar.USER32(?), ref: 002358FD

Strings

0, xrefs: 0023588F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 53844c0be98206502a49d8727ca974a43f88a591037e47b3d7df6e6853e21c0e
Instruction ID: 9670b6c3a7547d83664262eb942b4f123fdb91a02ead97c743245b68d5d6af78
Opcode Fuzzy Hash: 53844c0be98206502a49d8727ca974a43f88a591037e47b3d7df6e6853e21c0e
Instruction Fuzzy Hash: CB018071510228EFDB219F11EC48BEEBBB4FF45360F108099E849E6151DB708AA4DF71

Function 0020007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee47a7223f7242acab3c207dd4d725205048fb0b64ba0a8ec5a3d60994128991
Instruction ID: b122dfdb9dd883f7dbf97817f647dd40b7f4b45a18270de495e9534f3a6df8dd
Opcode Fuzzy Hash: ee47a7223f7242acab3c207dd4d725205048fb0b64ba0a8ec5a3d60994128991
Instruction Fuzzy Hash: E2C13A75A1020AAFEB15CF94C894BAEB7B5FF48304F108598E905EB292D771EE51CB90

Function 001D3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001D3F0B
__alldvrm.LIBCMT ref: 001D410C
__alldvrm.LIBCMT ref: 001D412E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 238e2d485c1bdd6348fd66fad337d02c97da7c0e3184e38cd452d2114868519c
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: EAA16672E0078A9FEB25CF28C8917AEBBE4EF61350F18416FE5959B381C3389981C751

Function 0022342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00223459
CoUninitialize.OLE32 ref: 00223463
VariantInit.OLEAUT32(?), ref: 0022346E
VariantClear.OLEAUT32(?), ref: 0022371B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 2858b7bfb86b034abb04945e539baf4891cd8154dd46ebbabbd2208f945a4ee4
Instruction ID: 7a40a2aa8098fd9c885b13a09e3b7e442768a656fc2030af13aa7c0821c9af23
Opcode Fuzzy Hash: 2858b7bfb86b034abb04945e539baf4891cd8154dd46ebbabbd2208f945a4ee4
Instruction Fuzzy Hash: 37A16E79614311AFC700EF64D485A2AB7E9FF8D710F048859F9899B3A2DB34EE11CB91

Function 00200436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0023FC08,?), ref: 002005F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0023FC08,?), ref: 00200608
CLSIDFromProgID.OLE32(?,?,00000000,0023CC40,000000FF,?,00000000,00000800,00000000,?,0023FC08,?), ref: 0020062D
_memcmp.LIBVCRUNTIME ref: 0020064E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 069a83a544a8762fd81c8ccd8107735feb9a766cab74161f19b503cb6dd5c372
Instruction ID: c251f5981bac0d8125eb91463125b0b4f0377fdeb6768a3f331aea90eb676033
Opcode Fuzzy Hash: 069a83a544a8762fd81c8ccd8107735feb9a766cab74161f19b503cb6dd5c372
Instruction Fuzzy Hash: 61815E71A10209EFDB04DF94C984EEEB7B9FF89315F204558F506AB291DB71AE06CB60

Function 001E1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001E14C0

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c09de11e8124a13d428087d4a9bc8f4e6d90dbfaa024a46025036f223890e231
Instruction ID: b9775a532993c5e3205257989f2523f9d33b769643944b84fdfea71b7ecc2bfe
Opcode Fuzzy Hash: c09de11e8124a13d428087d4a9bc8f4e6d90dbfaa024a46025036f223890e231
Instruction Fuzzy Hash: BA412C31600950BBDB256BBA9C45BBE3AE5FF62370F14426AF419D73D2E734C8419262

Function 00236278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002362E2
ScreenToClient.USER32(?,?), ref: 00236315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00236382

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 742403977fb830239ea8a50da144099ce0a9a3faf7d41598596468d8f2386792
Instruction ID: 71b7d1c6f7ffe9d29371d67d52f21222c0ebc7b39963875639a3c514bf421f33
Opcode Fuzzy Hash: 742403977fb830239ea8a50da144099ce0a9a3faf7d41598596468d8f2386792
Instruction Fuzzy Hash: 83515EB591020AEFCF14DF58D8889AE7BB9FF45760F208199F9159B2A0D730EDA1CB50

Function 00221AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00221AFD
WSAGetLastError.WSOCK32 ref: 00221B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00221B8A
WSAGetLastError.WSOCK32 ref: 00221B94

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 6bd89c5807ba4524797fe576f4dab895f8d875a85c561b84f87d0fce5fcb409c
Instruction ID: 72f1ad3779f16b074697374d8b200683aa3d574ff16285249cc6dcb077edf730
Opcode Fuzzy Hash: 6bd89c5807ba4524797fe576f4dab895f8d875a85c561b84f87d0fce5fcb409c
Instruction Fuzzy Hash: 3E41D278600210AFE720AF24D88AF2A77E5AF55718F54844CF91A9F3D3D772DD528B90

Function 001DB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3f4a1256e993749b977aa1a9bc9ec742168c1776e2a8a99c4f5bb0e2945a0
Instruction ID: 0ad52fc19a0296e5c69dd9eeb33007ce18aa139a8c35994efc585dbd3ef8fa38
Opcode Fuzzy Hash: 15c3f4a1256e993749b977aa1a9bc9ec742168c1776e2a8a99c4f5bb0e2945a0
Instruction Fuzzy Hash: 0041CF72A04644EFD724DF38C881BAEBBA9EB98710F11452FF1539B382D771A9018790

Function 002156D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00215783
GetLastError.KERNEL32(?,00000000), ref: 002157A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 002157CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 002157FA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 857999db2367a655500c04a3220469400c1618ce13abcfa46718d8c4f477b450
Instruction ID: 26aeccb0b5d98175bd8476d22701b6f86c09771d8f154f0844231a31d90c9b37
Opcode Fuzzy Hash: 857999db2367a655500c04a3220469400c1618ce13abcfa46718d8c4f477b450
Instruction Fuzzy Hash: 86411D39610611DFCB11EF15D585A5EBBE2EF99320F198488EC4A6B3A2CB34FD41CB91

Function 001DD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,001C6D71,00000000,00000000,001C82D9,?,001C82D9,?,00000001,001C6D71,8BE85006,00000001,001C82D9,001C82D9), ref: 001DD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001DD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 001DD9AB
__freea.LIBCMT ref: 001DD9B4

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 7cc8a86d24050cfc92397f74b71aec9f5d3bd46ae4eb8ee56bb8aa28a24b61eb
Instruction ID: 36ef060dda2c80659e57cf0cd67c7eda17f017efa01ad57bd41b739a89009cd1
Opcode Fuzzy Hash: 7cc8a86d24050cfc92397f74b71aec9f5d3bd46ae4eb8ee56bb8aa28a24b61eb
Instruction Fuzzy Hash: B031F272A0020AABDF29DF64EC95EAE7BA5EF40314F164169FC04D7250EB36DD50CB90

Function 002352C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00235352
GetWindowLongW.USER32(?,000000F0), ref: 00235375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00235382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002353A8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 24a7ad400c8b6741cee4633d8d81a38ade6b9dbca81bb6c4ebc7dcfc5faa5909
Instruction ID: 9b6306779df70f8dd2cef41f5853a4338c8bc762c390593b0b2d9f72c10e71f7
Opcode Fuzzy Hash: 24a7ad400c8b6741cee4633d8d81a38ade6b9dbca81bb6c4ebc7dcfc5faa5909
Instruction Fuzzy Hash: AF31C5B4A75A29EFEB349F14CC0AFE83765EB04390F584181FA18961E1C7F49DA0DB42

Function 0020AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0020ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0020AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0020AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0020ACC6

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 39d10935f206d1d5635e338387c3c8b5c67e3bd2102e5b0b620e54fa3cece55c
Instruction ID: e2e61b4be66ce74adf1fcd1f7116ad5efd8200e46959aab9a1265462491bcd6f
Opcode Fuzzy Hash: 39d10935f206d1d5635e338387c3c8b5c67e3bd2102e5b0b620e54fa3cece55c
Instruction Fuzzy Hash: 71312630A24719AFFF35CF648C097FE7BA5AB89310F85431BE485961D2C37489A18B52

Function 00237674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0023769A
GetWindowRect.USER32(?,?), ref: 00237710
PtInRect.USER32(?,?,00238B89), ref: 00237720
MessageBeep.USER32(00000000), ref: 0023778C

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9ac3c2fd2692b3153637165fc442310dfc05e458bf5e4b768ea706ed609c3384
Instruction ID: 94fe7ef6f0eaa5b83766cf3b78c08608a899c3d747d86b56cc39a5469e9f1b76
Opcode Fuzzy Hash: 9ac3c2fd2692b3153637165fc442310dfc05e458bf5e4b768ea706ed609c3384
Instruction Fuzzy Hash: 12419CF4A15215EFCF21CF58D899EA9B7F4BF49314F1440A8E5149B261C330E9A2CF90

Function 002316DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002316EB

Part of subcall function 00203A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00203A57
Part of subcall function 00203A3D: GetCurrentThreadId.KERNEL32 ref: 00203A5E
Part of subcall function 00203A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002025B3), ref: 00203A65

GetCaretPos.USER32(?), ref: 002316FF
ClientToScreen.USER32(00000000,?), ref: 0023174C
GetForegroundWindow.USER32 ref: 00231752

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c1ae3a35c4886b05b52b8c542683306db877fdddb12b53a607729d44fa630326
Instruction ID: 9ff6b85bb49835769f1fce44446409e5f94e2e64166adb957cc087dfd073bf7e
Opcode Fuzzy Hash: c1ae3a35c4886b05b52b8c542683306db877fdddb12b53a607729d44fa630326
Instruction Fuzzy Hash: E83161B5E10209AFCB00EFA9C881CAEF7FDEF59304B548069E415E7251D7319E45CBA0

Function 0020D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0020D501
Process32FirstW.KERNEL32(00000000,?), ref: 0020D50F
Process32NextW.KERNEL32(00000000,?), ref: 0020D52F
CloseHandle.KERNEL32(00000000), ref: 0020D5DC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 162b678d1f63b97661aa82270ef1ee9aeab28f2b147b35b41bc6bb63d3319b32
Instruction ID: a15d1f461ae3f1c853f0ddb245025af0232908154bf06eb2c0012bee73bf01b7
Opcode Fuzzy Hash: 162b678d1f63b97661aa82270ef1ee9aeab28f2b147b35b41bc6bb63d3319b32
Instruction Fuzzy Hash: D631C2710083019FD301EF64DC85AAFBBF8EFAA354F54092DF585961A2EB719944CB92

Function 00238FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

GetCursorPos.USER32(?), ref: 00239001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,001F7711,?,?,?,?,?), ref: 00239016
GetCursorPos.USER32(?), ref: 0023905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,001F7711,?,?,?), ref: 00239094

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8234e675be480c68ad74b247f72b6f3809784de36023d17b22793cef4588dc46
Instruction ID: 3c06c5f7824eadbe2ccfecaee6761af5b5aea62fa7f23dbd25a3819e1baadbf5
Opcode Fuzzy Hash: 8234e675be480c68ad74b247f72b6f3809784de36023d17b22793cef4588dc46
Instruction Fuzzy Hash: 3D21E275610118EFDB298F98DC58EFA3BB9EF8A350F104065F90557261C3719DA1DF60

Function 0020D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0023CB68), ref: 0020D2FB
GetLastError.KERNEL32 ref: 0020D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0020D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0023CB68), ref: 0020D376

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 63f0549ce63736c6cd422d87afa89d9b57c5b6e45cd9cbd753edb3b5f80f641a
Instruction ID: 178b8dfb626e7386ece19bb1690097ca33e358459effca8d9f703aafb064a3d5
Opcode Fuzzy Hash: 63f0549ce63736c6cd422d87afa89d9b57c5b6e45cd9cbd753edb3b5f80f641a
Instruction Fuzzy Hash: 8121BF7451A3029FC300DFA8D88186AB7E4AE56364F204A5DF899D72E2D730D956CF93

Function 00201571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00201014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0020102A
Part of subcall function 00201014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00201036
Part of subcall function 00201014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201045
Part of subcall function 00201014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0020104C
Part of subcall function 00201014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002015BE
_memcmp.LIBVCRUNTIME ref: 002015E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00201617
HeapFree.KERNEL32(00000000), ref: 0020161E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9f02cf79353054e084f5f09e0f308327dde137b439e3276a005df4806af83ca0
Instruction ID: 0d52308b8c6ba4720dad725c939db3ac5ba9266581798614808d0f6ddfced2ec
Opcode Fuzzy Hash: 9f02cf79353054e084f5f09e0f308327dde137b439e3276a005df4806af83ca0
Instruction Fuzzy Hash: 1D21CF31E10209EFDF04DFA4CD48BEEB7B8EF40344F184459E441AB282E731AA64DBA0

Function 00232782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0023280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00232824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00232832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00232840

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: b68c624c183b3ac72ffcc43d0d9bad75ae48e090bffbbc2c9126ccac46892985
Instruction ID: 5a0b1e5b54779b1ab6a1b1afc88f48e0fa987e26ddb4ee19cb698d53511fc921
Opcode Fuzzy Hash: b68c624c183b3ac72ffcc43d0d9bad75ae48e090bffbbc2c9126ccac46892985
Instruction Fuzzy Hash: F921F135218111EFD7149F24D844FAABB99EF85324F248158F4268B2E2CB71FC56CB90

Function 002078F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00208D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0020790A,?,000000FF,?,00208754,00000000,?,0000001C,?,?), ref: 00208D8C
Part of subcall function 00208D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00208DB2
Part of subcall function 00208D7D: lstrcmpiW.KERNEL32(00000000,?,0020790A,?,000000FF,?,00208754,00000000,?,0000001C,?,?), ref: 00208DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00208754,00000000,?,0000001C,?,?,00000000), ref: 00207923
lstrcpyW.KERNEL32(00000000,?), ref: 00207949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00208754,00000000,?,0000001C,?,?,00000000), ref: 00207984

Strings

cdecl, xrefs: 0020797B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9f8c6ac39a10ccdd8231fa78a303bd1da5381e2e4ce0d4aef6d715bb2fbe738a
Instruction ID: 5572d93e1d54f9924277575d462bdc7e3f3e1ebc3481070188897ded137f1142
Opcode Fuzzy Hash: 9f8c6ac39a10ccdd8231fa78a303bd1da5381e2e4ce0d4aef6d715bb2fbe738a
Instruction Fuzzy Hash: D011263A210346ABCB159F38DC49D7B77A9FF85350B10402AF846C72A5EB31E821D7A1

Function 00237CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00237D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00237D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00237D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0021B7AD,00000000), ref: 00237D6B

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 414243a102f3acd9a689809acd440681a9d1e15cce2a7870cf69751bac485aa5
Instruction ID: bd914bbe258b8f2ce36fe857d2e0a4d0e3a6130eee9f9d55b1677c85dcfea933
Opcode Fuzzy Hash: 414243a102f3acd9a689809acd440681a9d1e15cce2a7870cf69751bac485aa5
Instruction Fuzzy Hash: 8211D2B1224659AFCF209F28DC08EA63BA4AF45361F218724F939D72F0D7308971DB40

Function 00235660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 002356BB
_wcslen.LIBCMT ref: 002356CD
_wcslen.LIBCMT ref: 002356D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00235816

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: a9f3cc2e8c606e75df4b42cbb4e4afb1decbc8d0320acfa629e4aeb2bbd170b2
Instruction ID: cf728a5199ecb65c68ecf7a1380d3670676de3f5405e0e35d27b340e0714b5b2
Opcode Fuzzy Hash: a9f3cc2e8c606e75df4b42cbb4e4afb1decbc8d0320acfa629e4aeb2bbd170b2
Instruction Fuzzy Hash: 9E1106B162062596DF20DF65DC85AEE77BCFF15764F10402AF909D6081E7B0CAA0CF60

Function 001D1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca198a0b55bac97a11c2405f258573c62f6786046470bebd759a191049948d4
Instruction ID: 37db8c0d2eb59fa95e6f912c15d6ba514b948b1fc484fa7a2557e30560b1d5a4
Opcode Fuzzy Hash: 8ca198a0b55bac97a11c2405f258573c62f6786046470bebd759a191049948d4
Instruction Fuzzy Hash: E8016DB2209A567EFA2126B87CC9F67661EDF517B8B350327F536A13D2DB708C409170

Function 00201A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00201A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00201A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00201A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00201A8A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5af8b672318b9da5b9a488745000a29c3439099c75700ca603b2c3bcb01ad90d
Instruction ID: 22a0d43d6f9f29da9a49029a86d926715ebe83f278fa958701178722b64e781c
Opcode Fuzzy Hash: 5af8b672318b9da5b9a488745000a29c3439099c75700ca603b2c3bcb01ad90d
Instruction Fuzzy Hash: 3511F73AA01219FFEB119BA5CD85FADBB78EB08750F200091EA04B7295D6716E60DB94

Function 0020E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0020E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0020E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0020E24D

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 2aa766b199b5485c2b48aaa4b1370d90f89ff4763ff8195da6a797ce5bfd5bb8
Instruction ID: c6bbcdd37024315def9afd3b0e24a7292894fdafb2b651424d4476b2a3da1ff3
Opcode Fuzzy Hash: 2aa766b199b5485c2b48aaa4b1370d90f89ff4763ff8195da6a797ce5bfd5bb8
Instruction Fuzzy Hash: 7611E172904314BFCB019FA8BC0DA9A7BACAB45324F104669FC28E3291D2B0CD6087A0

Function 001CD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,001CCFF9,00000000,00000004,00000000), ref: 001CD218
GetLastError.KERNEL32 ref: 001CD224
__dosmaperr.LIBCMT ref: 001CD22B
ResumeThread.KERNEL32(00000000), ref: 001CD249

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 7600a6a4cb4779b8973521acb7ff1bfe657f9926968587643de42bb0ef6e586d
Instruction ID: 665b86a62571d2d0fd1923c2ba986f61cf1de3218df20ad771107189fcd8ec01
Opcode Fuzzy Hash: 7600a6a4cb4779b8973521acb7ff1bfe657f9926968587643de42bb0ef6e586d
Instruction Fuzzy Hash: 6001D276805204BBCB216BA5EC09FAE7A6DDFB1730F20026DF925921D0CF70C901D7A0

Function 00239EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

GetClientRect.USER32(?,?), ref: 00239F31
GetCursorPos.USER32(?), ref: 00239F3B
ScreenToClient.USER32(?,?), ref: 00239F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00239F7A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: b42cc461eab1333fe6c1881a41d83049b052bc8dedcef4d2fee4c2d56dbc5ccf
Instruction ID: e7e2235f05ffd2cbbf6ab7a3f95c9f1ccefdd186e9710cbe62da95b44ab69533
Opcode Fuzzy Hash: b42cc461eab1333fe6c1881a41d83049b052bc8dedcef4d2fee4c2d56dbc5ccf
Instruction Fuzzy Hash: 1E115AB291011AABDB10EFA8D849DEE77B8FF46311F504451F911E3540D770BAE1CBA1

Function 001A600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A604C
GetStockObject.GDI32(00000011), ref: 001A6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 001A606A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 3ee0f847bbc1e9d51586a75a10c372e231211d51d448149c7479ad290ab64b01
Instruction ID: 3037f904e9d79aad46ca5210dce4db11595f3d722140c48678b7624457ed8606
Opcode Fuzzy Hash: 3ee0f847bbc1e9d51586a75a10c372e231211d51d448149c7479ad290ab64b01
Instruction Fuzzy Hash: C011AD72101908BFEF164FA49D48EEABB6DEF093A4F190201FA1462010C736DCA0EBA0

Function 001C3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 001C3B56

Part of subcall function 001C3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 001C3AD2
Part of subcall function 001C3AA3: ___AdjustPointer.LIBCMT ref: 001C3AED

_UnwindNestedFrames.LIBCMT ref: 001C3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 001C3B7C
CallCatchBlock.LIBVCRUNTIME ref: 001C3BA4

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 53f51f5c647c4a1ab081e3aa64f3998eb5cf9d67e4624089086b76bb4c417f70
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 6601E932100149BBDF125E95CC46FEB7B7DEF68754F048018FE5896121C732E961EBA0

Function 001D3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,001A13C6,00000000,00000000,?,001D301A,001A13C6,00000000,00000000,00000000,?,001D328B,00000006,FlsSetValue), ref: 001D30A5
GetLastError.KERNEL32(?,001D301A,001A13C6,00000000,00000000,00000000,?,001D328B,00000006,FlsSetValue,00242290,FlsSetValue,00000000,00000364,?,001D2E46), ref: 001D30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001D301A,001A13C6,00000000,00000000,00000000,?,001D328B,00000006,FlsSetValue,00242290,FlsSetValue,00000000), ref: 001D30BF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 06250be129061a07569bd8e629003f76a54bd4d234d0bdb4b9a80fcbc586dad9
Instruction ID: 8211aeb3be4b16f641c1052034947436bab78968f6521bc88b39e6779a449194
Opcode Fuzzy Hash: 06250be129061a07569bd8e629003f76a54bd4d234d0bdb4b9a80fcbc586dad9
Instruction Fuzzy Hash: F601DB36741322ABCB314B79BC8C9577B98AF45B61B250621FD26F7340D721D941C7E1

Function 00207464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0020747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00207497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 002074AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 002074CA

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: cab25654a7accf98233c5fda481053d2f01d58be4418570a2bf36bb35e1ba9d2
Instruction ID: b66808df0d12f1390c20c2a242afda6458ffb18ea4dfaf920e27ed93bbaec051
Opcode Fuzzy Hash: cab25654a7accf98233c5fda481053d2f01d58be4418570a2bf36bb35e1ba9d2
Instruction Fuzzy Hash: A5116DB5A25315ABF7208F14EC09B937BFCEB00B04F208569A656E6192D7B0F914DB60

Function 0020B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B126

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: a7b8d0006c810e25affcc26e2db2cc909ff0d42894b47bc84c210a5c3ea6fe2c
Instruction ID: f21fec7c78ff7dc5995c0c10d69ee9e6af385393014b4937e459f5f7641f5092
Opcode Fuzzy Hash: a7b8d0006c810e25affcc26e2db2cc909ff0d42894b47bc84c210a5c3ea6fe2c
Instruction Fuzzy Hash: AE116D31C2162DE7CF21AFE4E958AEEFB78FF09711F104095D985B2182CB7056609B91

Function 00237E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00237E33
ScreenToClient.USER32(?,?), ref: 00237E4B
ScreenToClient.USER32(?,?), ref: 00237E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00237E8A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: ca7b92730c8a2b1e8c9d952662303caebdddb271f5dcf55683efcc6ef06934ef
Instruction ID: fe5c11eaed574f91ed43e1acaf11a74eaac78be1a102eb37b73cfac271af8cbc
Opcode Fuzzy Hash: ca7b92730c8a2b1e8c9d952662303caebdddb271f5dcf55683efcc6ef06934ef
Instruction Fuzzy Hash: 041143B9D0020AAFDB51DF98D8849EEBBF9FB08310F505056E915E2210D735AA64CF50

Function 00202DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00202DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00202DD6
GetCurrentThreadId.KERNEL32 ref: 00202DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00202DE4

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: c22826b627b033787347ae3e30f9f7bfebb2ca0eeeb0e36837b79b7643f646eb
Instruction ID: 9ac2390e176f80dad295265fa1b0c63c865978cb9272bb41adc7d5df8774ccf7
Opcode Fuzzy Hash: c22826b627b033787347ae3e30f9f7bfebb2ca0eeeb0e36837b79b7643f646eb
Instruction Fuzzy Hash: 95E09271111324BBDB202F72AC0EFEB3E6CEF83BA1F100016F105E10819AA0C844CBB0

Function 00238863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 001B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001B9693
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96A2
Part of subcall function 001B9639: BeginPath.GDI32(?), ref: 001B96B9
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00238887
LineTo.GDI32(?,?,?), ref: 00238894
EndPath.GDI32(?), ref: 002388A4
StrokePath.GDI32(?), ref: 002388B2

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 08b78f28874c17f7bf368e277cbe902dc9ae83c9c7b7c7d54312e37f00518d31
Instruction ID: 418e12f07b903b1f7d0d938f9577591b741142db7aefe42415eb8d479126e8f6
Opcode Fuzzy Hash: 08b78f28874c17f7bf368e277cbe902dc9ae83c9c7b7c7d54312e37f00518d31
Instruction Fuzzy Hash: 44F03A36055699FADB125F98AC0DFCA3B69AF06710F148000FB12750E2C7755562DBA5

Function 001B98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 001B98CC
SetTextColor.GDI32(?,?), ref: 001B98D6
SetBkMode.GDI32(?,00000001), ref: 001B98E9
GetStockObject.GDI32(00000005), ref: 001B98F1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: e5a94974029ad726918ef27b250e38f6dcf436c00b4312fcbf9df14fb15d1e83
Instruction ID: 0e8d50e406c5d4b13272c94900c171f46051e71a575f8c5052682ca0ac862ad4
Opcode Fuzzy Hash: e5a94974029ad726918ef27b250e38f6dcf436c00b4312fcbf9df14fb15d1e83
Instruction Fuzzy Hash: A9E06531244244AADF215B74BC0DBE83F10AB11335F148219F7F9640E1C37146419F10

Function 0020162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00201634
OpenThreadToken.ADVAPI32(00000000,?,?,?,002011D9), ref: 0020163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002011D9), ref: 00201648
OpenProcessToken.ADVAPI32(00000000,?,?,?,002011D9), ref: 0020164F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 3b31d8b2ac6644b43f544bda15ad6556a306e0eb211a0e779f79683f342ad558
Instruction ID: f0b0f4540e2284a212ec361aec6a6df35762fef0fc4df28e36beabd1b8eb4b38
Opcode Fuzzy Hash: 3b31d8b2ac6644b43f544bda15ad6556a306e0eb211a0e779f79683f342ad558
Instruction Fuzzy Hash: 68E08C32602312EBD7202FA0BE0DB873B7CAF44792F248808F745E9080E7348454CB60

Function 001FD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001FD858
GetDC.USER32(00000000), ref: 001FD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001FD882
ReleaseDC.USER32(?), ref: 001FD8A3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: cb8fd5c56c2c142d277ca696be2eaf44290aa5ae206666f1f647b58683399098
Instruction ID: 156b5b5f25c00900ca3bd064470d244a6a5f3bcae617950a55d815b01e427bda
Opcode Fuzzy Hash: cb8fd5c56c2c142d277ca696be2eaf44290aa5ae206666f1f647b58683399098
Instruction Fuzzy Hash: 16E012B5800204EFCB45AFA0E80DA6DBBBAFB48310F218009F956F7260CB398901AF40

Function 001FD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001FD86C
GetDC.USER32(00000000), ref: 001FD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001FD882
ReleaseDC.USER32(?), ref: 001FD8A3

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f334cc184a7e9e7766dfad707e5ab2f34b8c21d6d1cb87edcd24a0568b5ef906
Instruction ID: 96e24f596903e389fad2fbb782586d3b99fc44082606cc36678e331ea1ba8483
Opcode Fuzzy Hash: f334cc184a7e9e7766dfad707e5ab2f34b8c21d6d1cb87edcd24a0568b5ef906
Instruction Fuzzy Hash: 17E012B5800200EFCB44AFA0E80D66DBBB9BB48310F208009F95AF7260CB389901AF40

Function 00214D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00214ED4

Strings

LPT, xrefs: 00214DFB
*, xrefs: 00214E10

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: ee3476dac2a4ac7e10404baed130a486953064263e0f595d510fb8c714d9e2bc
Instruction ID: 5178a37a77c354cd9932f94864ec6520456e31ae5877dda66500bcf1dd627953
Opcode Fuzzy Hash: ee3476dac2a4ac7e10404baed130a486953064263e0f595d510fb8c714d9e2bc
Instruction Fuzzy Hash: 08918375A102059FCB14EF58C484EE9BBF1BF59304F198099E40A9F7A2C771EE96CB90

Function 001CE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001CE30D

Strings

pow, xrefs: 001CE2E5, 001CE302

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: aa66bd10f75608c2a2c7cc4d47e2c795c8b7ec4b96a194222a381f080903eccb
Instruction ID: 9c9a9b71136e7c10f9856e7d2d0bd99d2fc7f0e86ad445112a140b01507f1b19
Opcode Fuzzy Hash: aa66bd10f75608c2a2c7cc4d47e2c795c8b7ec4b96a194222a381f080903eccb
Instruction Fuzzy Hash: 98515B61A0C60296CB157718D905B7E3BE4AF60740F704D9EF0D6823E9FB34CC959A46

Function 00227771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(001F569E,00000000,?,0023CC08,?,00000000,00000000), ref: 002278DD

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

CharUpperBuffW.USER32(001F569E,00000000,?,0023CC08,00000000,?,00000000,00000000), ref: 0022783B

Strings

<s&, xrefs: 002277C8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s&
API String ID: 3544283678-70216238
Opcode ID: b71f5df9d4e33f7a9eb54b540f84e9228cdc7ffa8a80635427c969296f5ef637
Instruction ID: 3100df62cacdd060b23e71c85485ccb5c1972ec85e82235127ca22e741debe54
Opcode Fuzzy Hash: b71f5df9d4e33f7a9eb54b540f84e9228cdc7ffa8a80635427c969296f5ef637
Instruction Fuzzy Hash: 23616C3A928229ABCF04EFE4EC91DFDB378BF25300B444125F542A7091EF745A59DBA0

Function 001BE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 001BE1B1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 7c4adbff086ed8e7abb0c6354a301f250788623e45ae7a301f9c86912f0ec506
Instruction ID: 1673effe38fa71506ebe88024a08d0b11f6e5ab8eff0f42f89af94672708b3cc
Opcode Fuzzy Hash: 7c4adbff086ed8e7abb0c6354a301f250788623e45ae7a301f9c86912f0ec506
Instruction Fuzzy Hash: 5951373950424ADFDB19EF68C481AFA7BE4EF65310F2441A5FD519B2E0D7349D42CB90

Function 001BF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 001BF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 001BF2BB

Strings

@, xrefs: 001BF2AF

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 6c902aea5269dab2d88c5f0b4a981f0e37db0c1dcd16728d4b73e26c85044fe5
Instruction ID: c429563eeb7118e5e4856ab64c79053606283e308d1294a211e0ea5ba3f81d4e
Opcode Fuzzy Hash: 6c902aea5269dab2d88c5f0b4a981f0e37db0c1dcd16728d4b73e26c85044fe5
Instruction Fuzzy Hash: E75135714087449FD320AF14EC86BABBBF8FF96300F81885DF1D9411A5EB708529CB66

Function 00225745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 002257E0
_wcslen.LIBCMT ref: 002257EC

Strings

CALLARGARRAY, xrefs: 002257E6, 002257EB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 721f8580a70380d36e2644ec05968e886910ede7d54856690aebd877bb22b4b8
Instruction ID: 1f8f0deaf5c8de54a3be5cf00f989ee39d3c64694e97d768848ef11794fc3bd6
Opcode Fuzzy Hash: 721f8580a70380d36e2644ec05968e886910ede7d54856690aebd877bb22b4b8
Instruction Fuzzy Hash: FD41B035E10229AFCB04DFA8D8858FEBBB5FF59320F108029E505AB291D7B49D91CB91

Function 0021D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0021D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0021D13A

Strings

|, xrefs: 0021D10B

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 1fdc9b224ae7cdd0dcfc38d0ec8bc9a4ce6ed6d4e4936f20f443f32605fac7f0
Instruction ID: bfa06acd0e91e9ed6a18baca2103c8ad95e7a1442d2b4990714258d31b78d7e5
Opcode Fuzzy Hash: 1fdc9b224ae7cdd0dcfc38d0ec8bc9a4ce6ed6d4e4936f20f443f32605fac7f0
Instruction Fuzzy Hash: 0A314C75D10219EBCF15EFA4CC85AEEBFB9FF29300F100019F819A6162D735AA56CB50

Function 0023356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00233621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0023365C

Strings

static, xrefs: 002335BC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 2617cf93f72136e3a1a48e3b08af1c05ffce780724725d5575408a34f8fee5cd
Instruction ID: 12f395a417854d746ccfde389588b29ea991611a90c9d34b30a71ef38ef0c829
Opcode Fuzzy Hash: 2617cf93f72136e3a1a48e3b08af1c05ffce780724725d5575408a34f8fee5cd
Instruction Fuzzy Hash: 9E318EB1120205AEDB10DF28DC41ABB73ADFF98724F109619F8A5D7290DB30ADA18B64

Function 00234537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0023461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00234634

Strings

', xrefs: 0023458E

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 1d80595bd30c3c24395bb61cf55619b5871efb47fa3bc6847332264fea9bd199
Instruction ID: 64888165e32bc2f050894fbf068bedc4ec9221b864d319483a28f5c631f9c875
Opcode Fuzzy Hash: 1d80595bd30c3c24395bb61cf55619b5871efb47fa3bc6847332264fea9bd199
Instruction Fuzzy Hash: F63138B4E1030A9FDB14DFA9C981BDABBB9FF59300F5040AAE904AB341D770A951CF90

Function 002331EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0023327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00233287

Strings

Combobox, xrefs: 00233249

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 5ff997331d28ac886688c7f996de1ee7dead792fd06bd73227fa119678988a03
Instruction ID: 807f6fb7cb1ae7a927cebec230b8950a5efa76527baea2924913848bf55b844d
Opcode Fuzzy Hash: 5ff997331d28ac886688c7f996de1ee7dead792fd06bd73227fa119678988a03
Instruction Fuzzy Hash: 8711B2B13202097FFF25DE54DC85EBB376AEB94364F104228F9189B290D6719E718B60

Function 00233710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 001A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A604C
Part of subcall function 001A600E: GetStockObject.GDI32(00000011), ref: 001A6060
Part of subcall function 001A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 001A606A

GetWindowRect.USER32(00000000,?), ref: 0023377A
GetSysColor.USER32(00000012), ref: 00233794

Strings

static, xrefs: 00233757

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 7b50135d18279086594535a3e0d22aa6ebf7a9b07c85080dd945e1d2750efd54
Instruction ID: e8e651532ede15b6ef5a6f9fd98d0492bc63405daebcf37b47dc237d711e8b06
Opcode Fuzzy Hash: 7b50135d18279086594535a3e0d22aa6ebf7a9b07c85080dd945e1d2750efd54
Instruction Fuzzy Hash: EA113AB262020AAFDF00DFA8DC46EFA7BB8FF09314F104514F955E2250D775E9619B50

Function 0021CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0021CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0021CDA6

Strings

<local>, xrefs: 0021CD66

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 419964214cca7cc8eb0d44180b33283ba7450acfd807e380b24efec326753819
Instruction ID: 0a1f0be4c2d6efaf88c2e6b8f511582b39f59573db82ce67ca891c4ad424f5ae
Opcode Fuzzy Hash: 419964214cca7cc8eb0d44180b33283ba7450acfd807e380b24efec326753819
Instruction Fuzzy Hash: 8111CA7516563279D7384F66AC49FE7BEECEF227A4F204235B50993080D7709890D6F0

Function 00233429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002334AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002334BA

Strings

edit, xrefs: 0023348F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f5707817ccaa30c72e2426d0990cfdc1980fc05bd5d984abb88edfc2efb5d5f5
Instruction ID: 9d6f025a3bb4cc097cb52cdb551887db22510e3a2d4382fd55bd926b8fdde32b
Opcode Fuzzy Hash: f5707817ccaa30c72e2426d0990cfdc1980fc05bd5d984abb88edfc2efb5d5f5
Instruction Fuzzy Hash: F71191B1120209AFEB118F64EC44AFB376AEF15374F604324FA65A71E0C771DEA19B50

Function 00206C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00206CB6
_wcslen.LIBCMT ref: 00206CC2

Strings

STOP, xrefs: 00206CBC, 00206CC1

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: ee8177416cfac46d1970cbe0ae1c73c5a01f508de221039f7b3e1187c4eb4cf3
Instruction ID: 2e3ce15223835c5be5c5db297210d0eeb5c9fe175b16fd30df9a227d769e9ab1
Opcode Fuzzy Hash: ee8177416cfac46d1970cbe0ae1c73c5a01f508de221039f7b3e1187c4eb4cf3
Instruction Fuzzy Hash: 510104326206278BDB209FFDDC889BF33A4EA617107100529E852961D2EB31D870C650

Function 00201CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00201D4C

Strings

ListBox, xrefs: 00201D16
ComboBox, xrefs: 00201CEB

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 354241c07249f180039a608eff4fa6f853c4402c06f5966b9446370e02bb83cc
Instruction ID: f91b6fc2f7550856c47bfb4c5ec676d2533603855cf9eec8e55990b443eae72a
Opcode Fuzzy Hash: 354241c07249f180039a608eff4fa6f853c4402c06f5966b9446370e02bb83cc
Instruction Fuzzy Hash: F001D875621329ABCB08EFA4CC55CFE7368FF57350B14051AF822672C2EB3059688760

Function 00201BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00201C46

Strings

ListBox, xrefs: 00201C10
ComboBox, xrefs: 00201BE5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: aa7129dcf620c2c974153d5e7b4f47594eae715ad938834785a9c56c7cb14b12
Instruction ID: 8e89773cd7d317824a281c3243ccdc425dda57fb63e459c295689bfe0d586615
Opcode Fuzzy Hash: aa7129dcf620c2c974153d5e7b4f47594eae715ad938834785a9c56c7cb14b12
Instruction Fuzzy Hash: CC01A7756A121967DB08EB90D9529FF77AC9F22340F14001AF406772C2EA64DEB896B2

Function 00201C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00201CC8

Strings

ListBox, xrefs: 00201C94
ComboBox, xrefs: 00201C69

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: d2d830285212d90589240d57428913b512eb3813a1a1dce5f5f7b5ec1ba8465a
Instruction ID: 50a91dd1b3b45f13681fa6655aa8e3ad4cd60b728dccacba857aab9c1dd3a7e8
Opcode Fuzzy Hash: d2d830285212d90589240d57428913b512eb3813a1a1dce5f5f7b5ec1ba8465a
Instruction Fuzzy Hash: FB01DB7565021967DB04EB90CA11AFE73AC9B22340F140016B801772C2EA60DF78D672

Function 00201D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00201DD3

Strings

ListBox, xrefs: 00201DA0
ComboBox, xrefs: 00201D75

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: def0fb49c0e783d9c145953e7ad7dcd842f13cdbb498dac317ee37ba26ec587c
Instruction ID: b09294dd544ad7a27f52881e23eb290d6a15e8c19c9e3f9599877dad433f9f12
Opcode Fuzzy Hash: def0fb49c0e783d9c145953e7ad7dcd842f13cdbb498dac317ee37ba26ec587c
Instruction Fuzzy Hash: 3AF0F475A6072966DB08EBA4CC52AFE737CAB13354F040915F822A72C2DB6059288660

Function 00238172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00273018,0027305C), ref: 002381BF
CloseHandle.KERNEL32 ref: 002381D1

Strings

\0', xrefs: 0023818A

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0'
API String ID: 3712363035-3769339230
Opcode ID: a9f4d4bbd627eeb484d93694e15f1b4318dca10dcdc2016d0c3cd68cc2a7b34e
Instruction ID: d91c9898265e96a89bdd38d729ad7b9ddb4f2966ea00217951a19b56aa6eb650
Opcode Fuzzy Hash: a9f4d4bbd627eeb484d93694e15f1b4318dca10dcdc2016d0c3cd68cc2a7b34e
Instruction Fuzzy Hash: C8F05EB2650310BBE320AB61BC49FB73A5CEB19750F004465FB0CE51A2D6798A50A3B9

Function 0022747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00227493
_wcslen.LIBCMT ref: 002274B9

Strings

3, 3, 16, 1, xrefs: 00227483

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 2439d12f9c9ab53729e26bd9081cc94c477b7e2c3c6b676de7f19d616e912a1f
Instruction ID: cfe944c3541b4ce902293f1c64e3f187dac53fd55388b427ab9ebe28aa3530c5
Opcode Fuzzy Hash: 2439d12f9c9ab53729e26bd9081cc94c477b7e2c3c6b676de7f19d616e912a1f
Instruction Fuzzy Hash: 7CE02B0662C23171923136B9BCC1EBF5699DFEA754710182FF981C2266EBA4CDB1D3A0

Function 00200B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00200B23

Strings

Error allocating memory., xrefs: 00200B1C
AutoIt, xrefs: 00200B17

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: b9d4c85481337d4d9469414414347a3c8491a8190fa56f229794dbc5d45889b2
Instruction ID: 0cbe9ffec44b0db75050cf8171562f78fc7f8daad0e2ade2ba5b7efaad928895
Opcode Fuzzy Hash: b9d4c85481337d4d9469414414347a3c8491a8190fa56f229794dbc5d45889b2
Instruction Fuzzy Hash: 01E0D83125431826D21037947C03FD97B848F16B21F20042AFB58654C38BD1A4A007E9

Function 001C0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001BF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,001C0D71,?,?,?,001A100A), ref: 001BF7CE

IsDebuggerPresent.KERNEL32(?,?,?,001A100A), ref: 001C0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,001A100A), ref: 001C0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 001C0D7F

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 8a7255c974c4c33af36c3a2768772f265cf44f6b232d79d523d7895211d5d7d6
Instruction ID: 2d1181e1ca2e79b9a14f88844e4729407172d76559a13a35dfbd13a22303b0a6
Opcode Fuzzy Hash: 8a7255c974c4c33af36c3a2768772f265cf44f6b232d79d523d7895211d5d7d6
Instruction Fuzzy Hash: BBE092B42003518BD3719FBCF9087527BE0AF28740F00496DE887D6651DBB4E4448B91

Function 001BE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001BE3D5

Strings

8%', xrefs: 001BE3CA
0%', xrefs: 001BE3B5

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%'$8%'
API String ID: 1385522511-1499395184
Opcode ID: 61291ae20cf9a714aa371d4bf0a1c9a0fdc40ede354b8d6a430bfa36b7305f0a
Instruction ID: aac34d0abd49a777448d2187bef8bf9712b5d6a59b19c7b17d96ec7e81bd71d4
Opcode Fuzzy Hash: 61291ae20cf9a714aa371d4bf0a1c9a0fdc40ede354b8d6a430bfa36b7305f0a
Instruction Fuzzy Hash: 36E08631414910CBCA0D9728BA59ECC33D5FB29328B915169E11A871E39B35A8858755

Function 00213017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0021302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00213044

Strings

aut, xrefs: 00213038

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: afe3590a80f85913c2ec292f253b0850c1b5e17a97d80fd6257902e22da2bc00
Instruction ID: ba8b9d313e0cee64a3b5bc57dbc0e3464b80e0cda9e1cb5ed75ab9af93f07fbe
Opcode Fuzzy Hash: afe3590a80f85913c2ec292f253b0850c1b5e17a97d80fd6257902e22da2bc00
Instruction Fuzzy Hash: 7DD05E7260032867DA20A7A4AC0EFCB3A6CDB05750F0002A1BA55E2091DAB09984CBD0

Function 001FD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001FD220

Strings

%.3d, xrefs: 001FD22B
X64, xrefs: 001FD2A8

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 110b4c5ee548f302a830e91b498a003ceb7aed1f72770c778e1a67e5790ca36a
Instruction ID: 39176ba3a5c55f20c2b8ba93186dc9737781cba3c03130b2c2d3a4c4bc7dc611
Opcode Fuzzy Hash: 110b4c5ee548f302a830e91b498a003ceb7aed1f72770c778e1a67e5790ca36a
Instruction Fuzzy Hash: A5D0126180810CE9CB5897D0FC498FAB37DAB19341F618452FE06A1040E724C55867A2

Function 00232322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0023232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0023233F

Part of subcall function 0020E97B: Sleep.KERNELBASE ref: 0020E9F3

Strings

Shell_TrayWnd, xrefs: 00232325

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f706e29959806c6d095d6365620674baf0f60b24053d69e3a7609d74e5fc6662
Instruction ID: 5ffecf551b43f46cc33f006bfeeaa7339334202544e5b7edcd8108e8d3781b21
Opcode Fuzzy Hash: f706e29959806c6d095d6365620674baf0f60b24053d69e3a7609d74e5fc6662
Instruction Fuzzy Hash: EAD0C9763A4310B6E668A770AC4FFC6BA189B41B10F1149167645BA1D1C9A0A8518B54

Function 00232356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0023236C
PostMessageW.USER32(00000000), ref: 00232373

Part of subcall function 0020E97B: Sleep.KERNELBASE ref: 0020E9F3

Strings

Shell_TrayWnd, xrefs: 00232365

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 38c9079729bd742b26d3c73ed531af2c7226aa00cfe5a7aaed54799540a7525c
Instruction ID: e7ee247d6d5b6106ccc76ab62d0e1cea407576e0de81fa169514c7822a28be81
Opcode Fuzzy Hash: 38c9079729bd742b26d3c73ed531af2c7226aa00cfe5a7aaed54799540a7525c
Instruction Fuzzy Hash: B3D0C9723D13107AE668A770AC4FFC6B6189B45B10F5149167645BA1D1C9A0A8518B54

Function 001DBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 001DBE93
GetLastError.KERNEL32 ref: 001DBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001DBEFC

Memory Dump Source

Source File: 00000000.00000002.2897119788.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2897093097.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897201640.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268797.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897290387.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: a363d4faf45bfbe32c02bf5e9ddd273b54a94ca079bd89ca33d26de0f6fea4cd
Instruction ID: 74981f64dc07b36e26639c44b4e15711a21daed37db84c33db797a0f1749aed6
Opcode Fuzzy Hash: a363d4faf45bfbe32c02bf5e9ddd273b54a94ca079bd89ca33d26de0f6fea4cd
Instruction Fuzzy Hash: 5141E435608246EFCF258F65CCC4BBA7BA5AF51320F26416AF95A973A1DB309C01DB60

Source: Joe Sandbox View	IP Address: 13.107.246.57 13.107.246.57
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725751580&P2=404&P3=2&P4=LexUDh4k1UVqbuxF1GnzVHV0MJK8nMmcz6sGKQuIesQQ3rCA1Zr4HlUzgKgZ1OFlqAL%2bwKA%2bevp37Cv0b2meYg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: /bSlhs2Ia+3LIbDXlJtrHiSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.100
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.238
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\03bafe1c-bb9e-4714-adfd-856c201a05bd.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0a6597e2-ad1e-42f3-b73f-d9ff0b9f4570.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0b0453c1-db7a-45c6-bc86-7136e413c374.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1f37626a-f07a-458f-b924-cf59f423cdd0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\24f73c25-2e79-4f29-aa68-fd82f0d82252.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\27bd07da-2e66-42a1-bad9-f64bb25ad9c3.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3814454f-a4ba-41e0-8968-dada57e15464.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\90b74960-7372-4ff6-ab24-72327f1d437b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\12a967e4-750f-4e1a-b9a3-05243902c9d8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A684-158.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A684-1A78.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\16913a56-e754-4ef9-bebc-a66e7a1e0148.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\182ff923-bd10-4faf-852c-4f7fe450e0b5.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre