Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502835
MD5:	02f05a4f911bd2da08549f1eec6ea277
SHA1:	d58d5d2125e732cee302ec8bc264cbee7ac60d43
SHA256:	0f3b6be147d1935f932ea4c2ae02d3b6dd730be852a6314c9d5e4036d1b126a1
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 02F05A4F911BD2DA08549F1EEC6EA277)

msedge.exe (PID: 7472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7716 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1996,i,9922448481746041504,14044685848515789900,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7724 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8848 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3348 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7328 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2860 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4572 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9516 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9536 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 10048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2068,i,10994573958284707532,12861527657539237618,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2140,i,13012278448354238983,3491655061460600158,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,17889571995580524857,8444313851129401253,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Mon, 02 Sep 2024 09:15:57 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1725268557.2c239c0fAccess-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Mon, 02 Sep 2024 09:17:06 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.a6eb3717.1725268626.1271e2f9Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:

Source: file.exe, 00000000.00000002.2964011540.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr, ff88a3db-0bb5-404a-9ce5-5e10b6b5ce72.tmp.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: eff32382-0460-48b8-8c75-bf38a4699687.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: eff32382-0460-48b8-8c75-bf38a4699687.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: eff32382-0460-48b8-8c75-bf38a4699687.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49795 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0074EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0074EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0074ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0074ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0074EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0073AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0073AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00769576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00769576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_29f84c7c-5
Source: file.exe, 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_87ce20b1-b
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e5d31e93-7
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_29b8d909-1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0073D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0073D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00731201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00731201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0073E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0073E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D8060	0_2_006D8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00742046	0_2_00742046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00738298	0_2_00738298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070E4FF	0_2_0070E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070676B	0_2_0070676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00764873	0_2_00764873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DCAF0	0_2_006DCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FCAA0	0_2_006FCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006ECC39	0_2_006ECC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00706DD9	0_2_00706DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EB119	0_2_006EB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D91C0	0_2_006D91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F1394	0_2_006F1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F1706	0_2_006F1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F781B	0_2_006F781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E997D	0_2_006E997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D7920	0_2_006D7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F19B0	0_2_006F19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7A4A	0_2_006F7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F1C77	0_2_006F1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7CA7	0_2_006F7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075BE44	0_2_0075BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00709EEE	0_2_00709EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DBF40	0_2_006DBF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F1F32	0_2_006F1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006F0A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006EF9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/527@20/15

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007437B5 GetLastError,FormatMessageW,

0_2_007437B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007310BF AdjustTokenPrivileges,CloseHandle,		0_2_007310BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007316C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007451CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0075A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0075A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0074648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0074648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_006D42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\29722a84-3b9f-41c9-b61e-d28eb726cedb.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 20%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1996,i,9922448481746041504,14044685848515789900,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3348 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7328 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2860 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4572 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2068,i,10994573958284707532,12861527657539237618,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2140,i,13012278448354238983,3491655061460600158,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,17889571995580524857,8444313851129401253,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1996,i,9922448481746041504,14044685848515789900,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3348 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7328 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2860 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4572 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2068,i,10994573958284707532,12861527657539237618,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2140,i,13012278448354238983,3491655061460600158,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,17889571995580524857,8444313851129401253,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F0A76 push ecx; ret

0_2_006F0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_006EF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00761C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00761C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-94750

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6692

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7452

Thread sleep time: -66920s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6692 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0073DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007468EE FindFirstFileW,FindClose,	0_2_007468EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0074698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00749642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0074979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00749B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00745C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-94655

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0074EAA2 BlockInput,

0_2_0074EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00702622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F4CE8 mov eax, dword ptr fs:[00000030h]

0_2_006F4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00730B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00730B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00702622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006F083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F09D5 SetUnhandledExceptionFilter,	0_2_006F09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006F0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00731201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00712BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00712BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_006EF98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_007522DA

Source: C:\Users\user\Desktop\file.exe

0_2_00730B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00731663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00731663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F0698 cpuid

0_2_006F0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00748195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00748195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0072D27A GetUserNameW,

0_2_0072D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0070BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0070BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00751204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00751204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00751806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00751806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	21%	ReversingLabs
file.exe	21%	Virustotal	Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
svc.ha-teams.office.com	0%	Virustotal	Browse
s-part-0045.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://www.office.com/Office	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://msn.com	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
svc.ha-teams.office.com	52.123.243.70	true	false	0%, Virustotal, Browse	unknown
s-part-0045.t-0009.t-msedge.net	13.107.246.73	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	URL Reputation: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr, ff88a3db-0bb5-404a-9ce5-5e10b6b5ce72.tmp.12.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-staging.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	eff32382-0460-48b8-8c75-bf38a4699687.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
23.55.235.170	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.110	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.73	s-part-0045.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.65.228	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.32.110	unknown	United States	15169	GOOGLEUS	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.123.243.70	svc.ha-teams.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.251.163.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502835
Start date and time:	2024-09-02 11:14:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/527@20/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 312
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.21.239, 204.79.197.239, 13.107.42.16, 74.125.206.84, 13.107.6.158, 104.124.11.19, 104.124.11.32, 142.250.184.227, 142.250.184.195, 2.23.209.183, 2.23.209.131, 2.23.209.189, 2.23.209.186, 2.23.209.132, 2.23.209.185, 2.23.209.133, 2.23.209.130, 2.23.209.182, 142.250.185.206, 93.184.221.240, 192.229.221.95, 142.250.185.106, 142.250.74.202, 172.217.18.10, 172.217.16.138, 142.250.186.74, 142.250.186.138, 142.250.184.202, 142.250.186.106, 216.58.206.42, 142.250.185.234, 172.217.16.202, 142.250.185.74, 142.250.181.234, 216.58.206.74, 142.250.185.138, 142.250.186.42, 142.250.72.99, 142.251.35.163, 142.251.32.99, 142.251.41.3, 142.250.80.67
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, busi
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:15:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
10:15:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
10:15:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
10:15:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.14740.13049.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse
	0m4MDxiRIE.exe	Get hash	malicious	Unknown	Browse
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
23.55.235.170	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	0m4MDxiRIE.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
s-part-0045.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.73
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://nexgenodisha.in/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://l9sa.github.io/	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
svc.ha-teams.office.com	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.215
	file.exe	Get hash	malicious	Unknown	Browse	52.123.250.48
	file.exe	Get hash	malicious	Unknown	Browse	52.123.240.23
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.146
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.151
	file.exe	Get hash	malicious	Unknown	Browse	52.123.240.103
	IRF-BANKING INFO.xlsm	Get hash	malicious	Unknown	Browse	52.123.243.216
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse	52.123.245.173
	360a2293292ccc65368cab8ceee90670	Get hash	malicious	Unknown	Browse	52.123.240.57
	EXTERN Zahlungsbest#U00e4tigung.msg	Get hash	malicious	CVE-2024-21412	Browse	52.123.243.70
sni1gl.wpc.nucdn.net	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	172.236.2.84
	https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E	Get hash	malicious	HTMLPhisher	Browse	95.101.148.20
	http://staemcommunmitly.com/giftcarts/actlvation/feor38565Drgs7	Get hash	malicious	Unknown	Browse	95.101.149.47
	file.exe	Get hash	malicious	Unknown	Browse	104.70.121.171
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.5
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	172.236.2.84
	https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E	Get hash	malicious	HTMLPhisher	Browse	95.101.148.20
	http://staemcommunmitly.com/giftcarts/actlvation/feor38565Drgs7	Get hash	malicious	Unknown	Browse	95.101.149.47
	file.exe	Get hash	malicious	Unknown	Browse	104.70.121.171
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.5
CLOUDFLARENETUS	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse	172.64.155.119
	https://rgbegx.blogspot.pe/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	a5a5af3b-ae4b-2746-d08a-67229fed50bd.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://10eurodisconto.com?rid=iVbb6Xl	Get hash	malicious	Unknown	Browse	104.17.25.14
	PEDIDO DE COMPRA ROSSELL#U00d3.scr.exe	Get hash	malicious	Unknown	Browse	104.18.3.35
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	PO 18-3081.exe	Get hash	malicious	FormBook	Browse	172.67.176.77
	Status Update 2HCCR.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	EiTkH53St5.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.96.3
EDGECASTUS	https://pharmakon-my.sharepoint.com/:f:/g/personal/338im_apoteket_dk/EpWA_muYfpxOnnnQ0_fk-tQBEy5E4DvZpPAK2CbbLIvKuA?e=ORDGlm	Get hash	malicious	Unknown	Browse	152.199.21.175
	BAT6357377.exe	Get hash	malicious	FormBook	Browse	72.21.81.240
	Status Update 2HCCR.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://www.govern1.com/login/725553600988130?e=272348586	Get hash	malicious	Unknown	Browse	192.229.233.34
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://q7ke.glitch.me/?e=mthatha@africawsp.co.za	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	https://rgbegx.blogspot.pe/	Get hash	malicious	GRQ Scam	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	https://pharmakon-my.sharepoint.com/:f:/g/personal/338im_apoteket_dk/EpWA_muYfpxOnnnQ0_fk-tQBEy5E4DvZpPAK2CbbLIvKuA?e=ORDGlm	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	http://t.edmspread6.com/t.aspx/subid	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	http://10eurodisconto.com?rid=iVbb6Xl	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	Status Update 2HCCR.html	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183
	https://t.co/Tmh47fiTWd	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.114.59.183

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70911
Entropy (8bit):	6.072953551292829
Encrypted:	false
SSDEEP:	1536:aMGQ5XMBGcYmzpPLI+SLBxkLk9BlzGXfR7B4Kz1cP7w5b:aMrJM8Rwpk+Stxko9BVOJGKz1cP7E
MD5:	2BE0323694C14AF1DE71DA258B25C12B
SHA1:	2C71E5080D735D31053E259E87312F533CA4EEDC
SHA-256:	E65760CF5F169A0F4980F0B8CE2C4CC6DE310834A9D90FDAB927CCCCA40EB3F3
SHA-512:	E18C1DAAB7BCED9A3E0C6E0584AF11F643948AB38AA5F642CD6E649186F799C8D5BCBA935F9D3F66AF172F11633E782F45C0692C1A2AEBE57E04F21816C3CB50
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742103208775","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1dc35f69-9cdf-47a2-89b5-3c3d10e86c8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\488cd63f-0c42-43b3-af31-cc3acd1be6db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21006
Entropy (8bit):	6.066056972871053
Encrypted:	false
SSDEEP:	384:WtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSMJ/9QyBzCbyCvScdWFDVNMa2w:aMGQ7FCYXGIgtDAWtJ4no9RBzCOCvYDV
MD5:	5793E4C5803ABCD1DBA886E704F15BD4
SHA1:	9238AD13832CF7B78DD80444ED899D9DB8F7D6E2
SHA-256:	62700AF814A833B2699A642AA5E6156DEB8B24F47E41BA2304BB34B3FB6B690B
SHA-512:	B1C8813975F1EB933E4D8CA40A0FF39A6DA2CA28F8087C9F2D332A2E83E7617380F2D2583D23AE356E2A7CF2309C24DF1796860C7E913DEC840C011B74828163
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742103208775","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\66fc6aa8-cd02-40fb-9c94-e18ed8d92b5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70950
Entropy (8bit):	6.073026442790621
Encrypted:	false
SSDEEP:	1536:aMGQ5XMBGtYmzpPLI+SLBxkLk9BlzGXfR7B4Kz1cP7w5b:aMrJM86wpk+Stxko9BVOJGKz1cP7E
MD5:	5B3C74EAED5DB26D83E70AE0AB733B4A
SHA1:	63C4C4C02655A76B40857E91B86625262D6FF809
SHA-256:	0E1F536F9C16D01CB64D27178FD15F9A0226B7FBE2D779C227B6D45BF60E4F1C
SHA-512:	5AAA0F5A3B1D82B802875A6D8EA5D5C9736EFE0A1740EBAB587378492E852528C2E5A54A769728E14E22968AC99958643C2FE5999C342288F11FE61DF04ABA00
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742103208775","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7e1d3fca-daa1-4966-812f-85bd3f4d904b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.588166719417341
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afL0yHMm+RkHB+pdrxNvBexyAZfRbbCaJkXSc26wlRIOB0:Xq8NkC1fgyHN+IBuPvkxyWZ3rJkCcCLq
MD5:	2C6F4C65E98C598D6DEB245AC248141E
SHA1:	BA6AFBBC9B6BBCA62DC1440CF1DE88A9EBE3F15F
SHA-256:	94B3B6CE3D8219C3A2BBD8A3A2D384A1062F0E7F61A91D58EE7A0A1B186F35AD
SHA-512:	496E9C27B52C83DA4557E9CF27AEE1D3D3D918CF0745A3D45006D978FDDE81A4018D2074E5FD6CAD458F8AB1115F7526E876028847A2F2CC93CE9B72491827D0
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"policy":{"last_statistics_update":"13369742101030991"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\8496201e-c6c2-4d55-a212-35fdb6939182.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D58214-1D30.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040173581776235985
Encrypted:	false
SSDEEP:	192:VbEUjLYiVWK+ggCNlxJZzK1d9XEY1Pg+zFh/5NELohcRQ8NFZun8y08Tcm2RGOdB:hEUjjl1cKOhxxQjZu08T2RGOD
MD5:	940993253369C739237D071DA9847E43
SHA1:	99722F79D028EBF7DF58A41EA49637D315C961DB
SHA-256:	2659F47CD6256A8CA6C28B726581FF84D2B10B70FC0D383AF7B7FF01715A0734
SHA-512:	D2DCA968A57E886D39642B19ADA53830F3238475FA06BD619742ECF82EE506FE4DDBEE59C95058418F26B3BDD4FA1DCA05B4AE1586D1308C70705C5368CF95DA
Malicious:	false
Preview:	...@..@...@.....C.].....@................`..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yhiwlf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...................................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z.....\|?5.S@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D58215-1E2C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45759886314967807
Encrypted:	false
SSDEEP:	3072:jIvc1TanyZRc5M9Ohfv6n7TMy+CCRfE0hF+Xi36g1HF6s2rTeK9DNz6mqvNCp3zA:EGaZbyi36aHypuA9vEaHiBS6F
MD5:	37CDDB21DC076E05799207AB4AAEF469
SHA1:	24763983CF72C8B77E529CD6E29EEF041AC9C90A
SHA-256:	C626CE943321140FC85F7544A628C6B7342F3489AD771073CD09673995CA327B
SHA-512:	5347E8B7D1817221DB6BD7B58D4AB49D47BBA9D63931CB1B3907A7ACF159399C55379EB13932AC1993BEA6E79B52013A9B0E86CCE74B6EA25E0B0656F93B4FDF
Malicious:	false
Preview:	...@..@...@.....C.].....@................B..0B..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".yhiwlf20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.138171678988444
Encrypted:	false
SSDEEP:	3:FiWWltlMM3ckU2AViHSRqOFhJXI2EyBl+BVP/Sh/Jzvc9GSN4EQAo/Filtl:o1b3ckvAViyRqsx+BVsJD6GSK5A6GX
MD5:	73227A08DA9E1C445EC903C6BC5EC896
SHA1:	77E90059ABE23BEDF402E8C6B1329C7C6ACFED5E
SHA-256:	FE0CE7CE77D3EEDB279B23A700A9DD92D23BA4FECE79A9FD173CE3DF5C795AA1
SHA-512:	3A92EBA8E729B53F6A994C1938D32B94C62D6855A7137225CF1158E25441E60322A5903ACFD1AE43F6690BD999C7DD04B8140357AB39D6C8488E52E93C64F1FA
Malicious:	false
Preview:	sdPC....................MCe..A.G...A x."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................2e9ab8c7-706d-43fd-a500-ac3b0c76c777............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\11e3253d-fbaa-4161-a6b7-38aef6fc5646.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.977286445526658
Encrypted:	false
SSDEEP:	96:stQqfXis15Vb97l8kN8z24s85eh6Cb7/x+6MhmuecmAejDQP2Mz/EJ:stQFsDh8kNkNs88bV+FiAJPzMJ
MD5:	9028DE80520BED63070175A68EF1EF9F
SHA1:	418B5328CDC8D03BC815D33107E81FF7140832A3
SHA-256:	3C8F1145E659C64102DA6B45847A47E8ABAD91F8F4B14FDD0DAAA1F2D6BDE72D
SHA-512:	0802C0095A9C2853AA987B86A402E0A4BE2E0FC8674667C577E73F7BD3C868BB85D4004A3B37C4FC0D96B6C408B5E65E0BAE405DD61C83E67B725269280FD29E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369742102123639","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369742102124314"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\491ed7ea-5f27-4c7e-a067-672ad73027da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566308206754546
Encrypted:	false
SSDEEP:	768:X2+uZbwWPN1fXj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVspbOmrwnEBpGtux:X2+uZbwWPN1fXju1ja9dOjnRt6
MD5:	A6F679C2CB272EA6CA0D217EDBE457DC
SHA1:	14767CCFDB05C3927A1700B0972351708203389E
SHA-256:	778C32F599382DBEC00C559485E0C49D9440891A1C2D1B65D50149DB107EC2D9
SHA-512:	A0690A82F743408B49020DA6280C65E9140631605841FAFDBF573CB93B7F8FA4A88B016A3A32E06AA22D71A1813EFE4B6D140144D8EED0181CF760583E2D9652
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742101583814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742101583814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8a871b30-d44b-428b-aad1-9e7902c1f478.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.966999443498682
Encrypted:	false
SSDEEP:	96:stQqfXis15Vb97l8kN8z24s85eh6Cb7/x+6MhmuecmAejBk2Mz/EJ:stQFsDh8kNkNs88bV+FiAHPzMJ
MD5:	5DF564D70F2785286F5D805FA9F851F8
SHA1:	CF9208AE4B5C35EEFCE43B0F032F72FF631734B3
SHA-256:	DA38E7E7AE6A800859B87F734B3FD353F94C95145D1B8C17B46C846DC887A8B3
SHA-512:	790CDEB4AEB5F5E73DDBDFE1ED2D56DE34C63E11E6573E089342EA638E97B8AB75B063E6BCBA48D0E17551BDF7AD404B1F2192E4272E5CF398DA4C82457376C9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369742102123639","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369742102124314"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321675198417254
Encrypted:	false
SSDEEP:	192:dAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:GOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	200075FE4BA65C7F7DA7757334D459FF
SHA1:	B7C3FB8CED9360C4E7FB2B39C45A19450069F4DE
SHA-256:	7BD483CAA870047215B3087AD406FC64A7040D86632F2BF456C4A1551DF7068C
SHA-512:	D178ADA561B3708C0FC54D1F9686AF446F165268DCA0244A00D610D42819EC5AAFF68A070703CDCFC1B25B5618682AC80DB280729D88C3B244D56FB7F768FED5
Malicious:	false
Preview:	...m.................DB_VERSION.1..+z.................QUERY_TIMESTAMP:arbitration_priority_list4...13369742107080960.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.128245313336119
Encrypted:	false
SSDEEP:	6:P3aBnd3B1wkn23oH+TcwtOEh1ZB2KLll3acQ+q2Pwkn23oH+TcwtOEh1tIFUv:P3gnlkfYebOEh1ZFLn3ZvYfYebOEh16g
MD5:	FB64E4A95C1785DC31F7F565E303EAA6
SHA1:	6B0FC295B1FA993174DFDACD707E9D533DA1DAEE
SHA-256:	524A9E3D3D28CF9BF699115A26B1FABF547EF1E6ED8B08A61B60665C484B4145
SHA-512:	4FB78EC89CDE06828B860DC607BFFA6A6C9AA4659CC68214136781BBC04BD584FBBF8E354B16CF9285252BB54D4B22E17115A80709174982865B6ACABBA0D871
Malicious:	false
Preview:	2024/09/02-05:15:06.099 22b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/02-05:15:06.170 22b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04419426033731036
Encrypted:	false
SSDEEP:	6:/Fii2vlG+lCkM/lO+0/YscLdQx4j+kll4ry0s/lu:d4FtEUuLdHz/4rq
MD5:	557DEA3AA589F8D3798A18A3FDE2C03E
SHA1:	43091A5D8DEAB162FD81290471E608964C7A28F9
SHA-256:	2A0979090DBB06D8D6587C19DC64C10BC4A6061214C9D92F0E886B2900DDC81D
SHA-512:	42F28D2F45E75F5FECE326BCE50A038FB5CBA5C1DC5D3DEE6F10C9C8E0429AFBC9B8F4C86AF70DA6EB93B3036EF04264A5D2443A3962E52FF3552EB0E05D9B34
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09568610407922552
Encrypted:	false
SSDEEP:	24:WrRV4XQ3eaPVHVcV4XeaPVHaUAPnQzLIoMmHVIRBNUem/1esQzEul6YT38EWp46:6V4A3esWV4XesrAzNUeg1cEET3lWp4
MD5:	0A7313BCF2CADF8A8F56C6A1C0AD137F
SHA1:	A882A473F1C3D6993094A9A0B9B3FFAAF3C51A18
SHA-256:	360FF4D524865B052B457ADEC428166751E1F6810B221EDE3E8C85ED7D66FDF8
SHA-512:	BBB15CE41436A67AFE5DE006A46E965FC4EC8F16761FBB739D11F2FC464BB718E2245FC80DD23830AE41669A5FEA57885BE2A1E463B7FFD86C79464C765230AB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2826848223954187
Encrypted:	false
SSDEEP:	384:A9mbJtM69mbJtM83LIJt/uLIJt/TL6Jtyi:AAbJtVAbJtMJt1JtaJth
MD5:	36CB464CF2C4D5E2887D80AD10FA261D
SHA1:	24CBA2DBA58A5770A6EEC0245C3E59D1D3A8D327
SHA-256:	E4762ABC8C3F1D6E5976F087FAE6E80FB430201934A29DA2991607DC3A746048
SHA-512:	605EF9CFCEE781924D66D7F60F7F5018958C47A071687BA8E6A77EA45DC48CA3201774A4B6E14005541E40F9379052D50BEA6A0B7DA8D32CDAC35266F3D90EA3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulsEQaal:Ls1EPa
MD5:	4E7E4CF781AA65A559FD66C63B4D12AE
SHA1:	88ADDB5212DADEA3ACCD9DB3E03C92267D176EA5
SHA-256:	9617D188BD7D02188DF686B2B60B595012BF2E45EF51193148FE8702B0FE766E
SHA-512:	F8372AA810317CF2C95A5D3FE170BB1EBB2EDB79D5C4A895CE4EDD7738B46DD53812351A5BFF7E24A1EF8F2C803EBD4B7E11E3107979B053F03F5E108DA2ADF0
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:JWRFXAyEouCa+:Yrgtc
MD5:	90337BD494004DB1FA66746DF628A318
SHA1:	6063993A90DD2475A19A8E4B6E84D45689A82342
SHA-256:	89C636AEE9300E61C3CB73C706131E368BA573BDAECED6073D02FA6F3534D5E2
SHA-512:	10C68497B61AB2D2911FF65319603FB6F13D3FB56A1F821DAA4AA98C34D291FC8493BC200D2616FE3E88B5667D0720FC8CB408C812DD8F3256B78A3575347376
Malicious:	false
Preview:	(....3&Toy retne........................t..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:JWRFXAyEouCa+:Yrgtc
MD5:	90337BD494004DB1FA66746DF628A318
SHA1:	6063993A90DD2475A19A8E4B6E84D45689A82342
SHA-256:	89C636AEE9300E61C3CB73C706131E368BA573BDAECED6073D02FA6F3534D5E2
SHA-512:	10C68497B61AB2D2911FF65319603FB6F13D3FB56A1F821DAA4AA98C34D291FC8493BC200D2616FE3E88B5667D0720FC8CB408C812DD8F3256B78A3575347376
Malicious:	false
Preview:	(....3&Toy retne........................t..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.913890986728064
Encrypted:	false
SSDEEP:	3:RbCdEh9QZ+:4Khyc
MD5:	27F4F70F1A22D55F8953BFF940407FED
SHA1:	506443E1F19156F2E546C1911D911106C5AF78A6
SHA-256:	B87C54BCC9E62363782F90B9C1047A53A7493FEBC0803758028951112EDC178A
SHA-512:	CA2564F3910E29DA4B52DA7D53DA383FBCC1D5C13DC0A029E24532EE6459C22A9192DE12F0C424ECD690B09CF8FC76362D529782C5217E9F5E6FDA84DFA408BA
Malicious:	false
Preview:	(....~.}oy retne........................}...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.913890986728064
Encrypted:	false
SSDEEP:	3:RbCdEh9QZ+:4Khyc
MD5:	27F4F70F1A22D55F8953BFF940407FED
SHA1:	506443E1F19156F2E546C1911D911106C5AF78A6
SHA-256:	B87C54BCC9E62363782F90B9C1047A53A7493FEBC0803758028951112EDC178A
SHA-512:	CA2564F3910E29DA4B52DA7D53DA383FBCC1D5C13DC0A029E24532EE6459C22A9192DE12F0C424ECD690B09CF8FC76362D529782C5217E9F5E6FDA84DFA408BA
Malicious:	false
Preview:	(....~.}oy retne........................}...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlDQBt:Ls3M
MD5:	9EF5B0A85D90DAB2E7C03F63ECBB9BCF
SHA1:	D612B3A7E56DAB636E01D6357911389C540992F2
SHA-256:	10BF7F1CD1956D487CED83B512D202731E1DF97ADA2E75380D006F50A9204BFB
SHA-512:	2356896438B9601778BA4F1A7F2B103CA3D8F0348F00E44A7A1A639ACAA002F2F231217DA5D83ED858D9CCF14E8793459D073DE4AECFBC10DD91036FDCE6DE31
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541332360720455
Encrypted:	false
SSDEEP:	6144:UA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:UFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	1237349417A621A4BEAA6C863F0E8CAD
SHA1:	FDFDE41DE0F9414A764AF4BDF7E9D46F6AFB6149
SHA-256:	C014AD5B714FDEED118FF4CD5A525B5854CC80899F48AE58E284D3DAB7A430BC
SHA-512:	D61E7BE89AFEA446F526A300D57A63D11AFC49B4AF517544D36D74878808E664B47A67F2EA26AB75D3175D5D293DE61B11085011E6F66C1839A70332807BFC51
Malicious:	false
Preview:	...m.................DB_VERSION.1C..q...............&QUERY_TIMESTAMP:domains_config_gz2...13369742107090574..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.191451918808122
Encrypted:	false
SSDEEP:	6:P3aV4M1wkn23oH+Tcwtj2WwnvB2KLll3atVq2Pwkn23oH+Tcwtj2WwnvIFUv:P364rfYebjxwnvFLn3CvYfYebjxwnQF2
MD5:	D7DFCEFE85A039B306A6486E5321DE44
SHA1:	4A4F35ED4AF432A53CD9C547EAA1C54BF329DF8A
SHA-256:	C7D47DFA307D624E5AB2A6634F869900DE196521C72FC1101B56D4F83E513348
SHA-512:	BE2E7C5582E925C4C1F35A588BB39787E87D3A6D2A4221BAAC1F01C2B0B67FFF9F96F18D89EAA34BC35DAF258D816DF58E9AAFCD6942A0421906CB8A88EFC4B3
Malicious:	false
Preview:	2024/09/02-05:15:06.132 22d4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/02-05:15:06.195 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324620917084956
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Re:C1gAg1zfvm
MD5:	92BEE18ADFB6CBFE17441A3114AF1125
SHA1:	8D3D792151BC310BB53DED082DDC26FB4EE6B42C
SHA-256:	603C8A1EF4D9B05D1D9DCB737FAA49E73C333ED01ABE27FFA301B3277E274BF5
SHA-512:	AD6522D56BE8F3B04E08DE668EE9CF7F2FAD096F4F19363D9D62FDE994D0081038E7431352F8E25981295CB92D28DC6D8F620A301F0E658A0A54BDCB4684B8C2
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.1760480381010465
Encrypted:	false
SSDEEP:	6:P3rQERM1wkn23oH+TcwttaVdg2KLll3r6u6Vq2Pwkn23oH+TcwttaPrqIFUv:P3rRRrfYebDLn3r6u6VvYfYeb83FUv
MD5:	C6138584CABA9AA2246E009A0234323C
SHA1:	B21D186C9311419EF459A6A765991B976D98ED71
SHA-256:	9390DD12ED69C80986FA2961055FD4070BC551C8DF73CC940354CB7855EFF5B8
SHA-512:	D5AD2F6B183C2654F253A9DA6DE00CA158D9A6A0D5024153083425DB080CE91761FDF5032FE3503CB3642AB70F28F88AF097FB71D70F8A5BA12CCCE21C2AB858
Malicious:	false
Preview:	2024/09/02-05:15:01.639 1f04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/02-05:15:01.649 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.162562714633639
Encrypted:	false
SSDEEP:	6:P3rz3ERM1wkn23oH+Tcwtt6FB2KLll3rarVq2Pwkn23oH+Tcwtt65IFUv:P3rARrfYeb8FFLn3rarVvYfYeb8WFUv
MD5:	7F7E480AD41E9CE988353119E02A6732
SHA1:	379ACA2EA2AB49F6CC87008D142F65AE320FE415
SHA-256:	D425F94482CBADD9323FCC1D1CE9206E75ED207D0415FA0641ADAD9FC82BC53C
SHA-512:	002F7FA8D840CF841173D725B0C656A650A352EE0D94B61BA9F05DEA520A4C49AF9D25828485894D8709937EDE98E2CCC15183A1C9D6AFAD83818DFA59CFC2A2
Malicious:	false
Preview:	2024/09/02-05:15:01.652 1f04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/02-05:15:01.663 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.153700923640972
Encrypted:	false
SSDEEP:	6:P3A0M1wkn23oH+TcwttYg2KLll3zANN4q2Pwkn23oH+TcwttNIFUv:P3A0rfYebJLn3zk4vYfYeb0FUv
MD5:	CE2532900442A34F515D5832EBF56710
SHA1:	5EB487D9168371276D9CC219F95F267B165DBABD
SHA-256:	59A6C865AB098B110E34546A772FE6215A326F224E8B6466765E86E1BE79C701
SHA-512:	A58AFADBCCE39B1D10E8C6ED7B3B26FF945BC865BD222800769E59C06DD951E5379D5B0CAE36A2761C0CD56A038263A8086CDA1121D967EDD452CD08D3632FCB
Malicious:	false
Preview:	2024/09/02-05:15:03.353 1ef4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/02-05:15:03.364 1ef4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlTCl:Ls3TC
MD5:	70AA6D7C8CCC31C17DD2B6871714A1A7
SHA1:	0A7E275F14CDC6A9CFCF65C1D5872393CE06E19F
SHA-256:	05CFF8F6560CFE2BDD475EB1FADF7725C2416D0404C1FB8E3509624711BF9E80
SHA-512:	CE97BB8E603DE98642D4E38FBDB3C2E22391B7E75AA76A5622C9020D8F5B9A47033C9F491C31FED6D791D020E54C66EF96F64A51DA7995363B5C8573B6A046D7
Malicious:	false
Preview:	.........................................k.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:ISmZ/ntFlljq7A/mhWJFuQ3yy7IOWUYfv4/dweytllrE9SFcTp4AGbNCV9RUITFn:ISwk75fOOX4/d0Xi99pEYtF
MD5:	08FB65FD2C908BCB5A323139E82BF3EA
SHA1:	D36D834B09CFC815939F4A03DA49366C7ECA9CA1
SHA-256:	2D09E878B49F09FAD360CAA6FB711BF52D0AB538747350814C3F4259296A30B1
SHA-512:	BA73EDD136AE60E975B2D8EB36AF13BE17953413D8A110786097C2374E62B5697BADD300A6E07058D0AEDE3F5CC0A38F0B901C515844066DF1CED449C1585C8B
Malicious:	false
Preview:	..............7....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.227594618934635
Encrypted:	false
SSDEEP:	6:P302TmRq1wkn23oH+TcwtRage8Y55HEZzXELIx2KLll30A+q2Pwkn23oH+TcwtRz:P30eyfYebRrcHEZrEkVLn30FvYfYebRz
MD5:	43C4D9E94A04146A87A03A8AA40B9479
SHA1:	49F117A6C73A62FA55F7D6D6FC7DC4E4EED9D5B0
SHA-256:	CC3C72DEBF63F24B84BC38864FAF385CC6645D9802162FE4B7CDD064730FCA9A
SHA-512:	5978684D5BCD849C6D93D6E53972C3BBFD96F7F5675A691E3B9FE9E70223D56387510BBC908C64D70C21C5634D99CC893F4C3265F86CD3F42B9339A434E6BBAC
Malicious:	false
Preview:	2024/09/02-05:15:04.266 1ec8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/02-05:15:04.277 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.170680579961655
Encrypted:	false
SSDEEP:	6:P3GVWNiB1wkn23oH+TcwtRa2jM8B2KLll3GVQRMc+q2Pwkn23oH+TcwtRa2jMGIg:P3CGfYebRjFLn3CQZ+vYfYebREFUv
MD5:	F3547452986294219F2DBDD873C49656
SHA1:	4C79BC6A999A0352D19068CFFA7DF3B499EE6D01
SHA-256:	5E895002BC2850C65F33D75185611FBB0F2ABCDEB5009040FDC64129FA691BD4
SHA-512:	E0E488FB645CEAC24BB8CC9354FFD8F387C2A78B68CA77C4983E486228DB57397DB37705C7090A70C73987497086F881B2FDAC975E59A68DFBBB1B4A36B203C9
Malicious:	false
Preview:	2024/09/02-05:15:02.033 1fdc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/02-05:15:02.054 1fdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\48cbf23d-3efa-4a7f-a38f-a5a57fc4f3e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\79bc7891-b6d0-44e6-83b9-245b8422f2ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\82be3ea2-a9c2-49e6-acb4-f0fb3b6c3e93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\9c6dbe0e-71f3-433e-b5c1-62c6f40004be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3c62f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.760935725845389
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkkS:uIEumQv8m1ccnvS6G
MD5:	68F07E91E3E7952F7F6DD04DE99E3774
SHA1:	6BDF1541DB018BB8D16CCCB1396A6E057C500803
SHA-256:	DCADD917D87266F85D656375EEC4FFC3707A30D7E00BFC3FD4879DCD125179D9
SHA-512:	0322420187F6F3A589BEC036C2826FE687CE22D13FD8095DA0E3C42257C15A44832C024756B6B0A1FF241BC37E536B2A16640B54730ADC2705B0966961FC4BC4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2a81d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\d50086f3-0094-411f-8df3-9a46f0bdfd43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.966999443498682
Encrypted:	false
SSDEEP:	96:stQqfXis15Vb97l8kN8z24s85eh6Cb7/x+6MhmuecmAejBk2Mz/EJ:stQFsDh8kNkNs88bV+FiAHPzMJ
MD5:	5DF564D70F2785286F5D805FA9F851F8
SHA1:	CF9208AE4B5C35EEFCE43B0F032F72FF631734B3
SHA-256:	DA38E7E7AE6A800859B87F734B3FD353F94C95145D1B8C17B46C846DC887A8B3
SHA-512:	790CDEB4AEB5F5E73DDBDFE1ED2D56DE34C63E11E6573E089342EA638E97B8AB75B063E6BCBA48D0E17551BDF7AD404B1F2192E4272E5CF398DA4C82457376C9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369742102123639","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369742102124314"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF338c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.966999443498682
Encrypted:	false
SSDEEP:	96:stQqfXis15Vb97l8kN8z24s85eh6Cb7/x+6MhmuecmAejBk2Mz/EJ:stQFsDh8kNkNs88bV+FiAHPzMJ
MD5:	5DF564D70F2785286F5D805FA9F851F8
SHA1:	CF9208AE4B5C35EEFCE43B0F032F72FF631734B3
SHA-256:	DA38E7E7AE6A800859B87F734B3FD353F94C95145D1B8C17B46C846DC887A8B3
SHA-512:	790CDEB4AEB5F5E73DDBDFE1ED2D56DE34C63E11E6573E089342EA638E97B8AB75B063E6BCBA48D0E17551BDF7AD404B1F2192E4272E5CF398DA4C82457376C9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369742102123639","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369742102124314"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3adf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.966999443498682
Encrypted:	false
SSDEEP:	96:stQqfXis15Vb97l8kN8z24s85eh6Cb7/x+6MhmuecmAejBk2Mz/EJ:stQFsDh8kNkNs88bV+FiAHPzMJ
MD5:	5DF564D70F2785286F5D805FA9F851F8
SHA1:	CF9208AE4B5C35EEFCE43B0F032F72FF631734B3
SHA-256:	DA38E7E7AE6A800859B87F734B3FD353F94C95145D1B8C17B46C846DC887A8B3
SHA-512:	790CDEB4AEB5F5E73DDBDFE1ED2D56DE34C63E11E6573E089342EA638E97B8AB75B063E6BCBA48D0E17551BDF7AD404B1F2192E4272E5CF398DA4C82457376C9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369742102123639","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369742102124314"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566157709923853
Encrypted:	false
SSDEEP:	768:X2+uZbwWPN1fMj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVspbOmrwnEepGtug:X2+uZbwWPN1fMju1ja9dOjn0t3
MD5:	718BEEF3DC69A6664197E1F071E9417C
SHA1:	6D7153EDFF214170BFDDF42AD2C32918D814DAB6
SHA-256:	B5171A40B7943497A64A61AD763A31A17976E8C4B33AA687DB6637EA4B8840BC
SHA-512:	7BC9ABFA95C55E54BC59E80BAE68CDE5EC42F9220D43A58788B5DE0CB544315A8C14CF245CB899EE468C886AA1FEAB8F67BC6B7A7559D309A466C01B55024AD3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742101583814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742101583814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF3085e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566157709923853
Encrypted:	false
SSDEEP:	768:X2+uZbwWPN1fMj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVspbOmrwnEepGtug:X2+uZbwWPN1fMju1ja9dOjn0t3
MD5:	718BEEF3DC69A6664197E1F071E9417C
SHA1:	6D7153EDFF214170BFDDF42AD2C32918D814DAB6
SHA-256:	B5171A40B7943497A64A61AD763A31A17976E8C4B33AA687DB6637EA4B8840BC
SHA-512:	7BC9ABFA95C55E54BC59E80BAE68CDE5EC42F9220D43A58788B5DE0CB544315A8C14CF245CB899EE468C886AA1FEAB8F67BC6B7A7559D309A466C01B55024AD3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742101583814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742101583814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.139496464210903
Encrypted:	false
SSDEEP:	6:P3P7j3B1wkn23oH+TcwtSQM72KLll3PXMBG3+q2Pwkn23oH+TcwtSQMxIFUv:P330fYeb0Ln34i+vYfYebrFUv
MD5:	DE69FD026460C9EDD27A73B9FADBC406
SHA1:	8BECF80475E369C83A3B63B170D9034ACB62669C
SHA-256:	4386DF2BC932467CC62543BD39EC0057144DC58BDF001AEF6F2D98D3BCAD9572
SHA-512:	EFA4C84845CDBE9745E42F945A7DB754DA04543771F1A9F3F040E1408A4E3D1D437249C3ECD0FC2DE3C7F4B5BEEE9A8C4AF64839E8B98AD055474A71BAC9C061
Malicious:	false
Preview:	2024/09/02-05:15:19.153 1fdc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/02-05:15:19.179 1fdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.084677704005501
Encrypted:	false
SSDEEP:	6:P3NWM1wkn23oH+TcwtgUh2gr52KLll3lrVq2Pwkn23oH+TcwtgUh2ghZIFUv:P3wrfYeb3hHJLn35VvYfYeb3hHh2FUv
MD5:	ED11A6D694DD81E5E6BE575B87B363F2
SHA1:	3A4B41BA3AF4FC1801C83F9C6AA6E77919FD6324
SHA-256:	9262B06F6BCC3E052CB5BDB787451BF83A660EA2EA56DA4B1FECA4D5545B8F26
SHA-512:	BCC724ED957ADA35E9FB533471B6634E1AFBFEEDB658AD7AECC9D27C15097722F0B1520EAAB22E04319B09018E04B0EE1519BF966FEAF05793556E477184CA6D
Malicious:	false
Preview:	2024/09/02-05:15:01.554 1f14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/02-05:15:01.805 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsuluQa:LsEa
MD5:	6AE09703D2A520188BBF021A583C1727
SHA1:	C351645002E38097B05A13010D04E82B907ECD65
SHA-256:	415C25910D6913B3FECA07087C5EC7296CE60CBA509EBC9DAEAA0986CD7DC21A
SHA-512:	629B5E1D4C203F99EDF82660A95A4ED30823BFA7D6BE089089619132B3029D98B03CA2ABFD55D23F65DDF9C0D4805E0E5A77D25E1C9E399452E695E13F5F1A3A
Malicious:	false
Preview:	........................................vm..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:J8B0XTEKwV+n:y7U
MD5:	76ABA587AFDB480EC11A7AD5713D9196
SHA1:	964308A39E9C58CE2EAEABB12B6253CE722AAAAF
SHA-256:	A6C30AB23B27E2B318A15165B8217BCCDB507CFDBE216F0B1CAA57A03B062EAD
SHA-512:	AAF68AAE42BC90F160D5AE420326293A0174A7D582B71932DBBFFF392F5E198A7B7CA969907924E24C9F0AB3166D66BBDB2E81C7D51149C0F0C2F09F0CD2C885
Malicious:	false
Preview:	(......oy retne............................./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:J8B0XTEKwV+n:y7U
MD5:	76ABA587AFDB480EC11A7AD5713D9196
SHA1:	964308A39E9C58CE2EAEABB12B6253CE722AAAAF
SHA-256:	A6C30AB23B27E2B318A15165B8217BCCDB507CFDBE216F0B1CAA57A03B062EAD
SHA-512:	AAF68AAE42BC90F160D5AE420326293A0174A7D582B71932DBBFFF392F5E198A7B7CA969907924E24C9F0AB3166D66BBDB2E81C7D51149C0F0C2F09F0CD2C885
Malicious:	false
Preview:	(......oy retne............................./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:5fTE45gln:W0g
MD5:	42FA94DF40E10D6C413E109B7A061DA6
SHA1:	05D7190E9518C5D9D509DC7244373882A104DAFF
SHA-256:	E19A99AC13A1A2A3CAE98B7382F59CA547E78B7CE84E807B8177F45B720DA650
SHA-512:	E119E130287A2AC723BDBD3D341149A77F4F76B1FA293747ADA89C02F6B9B3AD9BB29AF1F531B643F4F8896B22050499475AB85F66EAC76CFCB1C04D9B07EA67
Malicious:	false
Preview:	(.......oy retne........................d\.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:5fTE45gln:W0g
MD5:	42FA94DF40E10D6C413E109B7A061DA6
SHA1:	05D7190E9518C5D9D509DC7244373882A104DAFF
SHA-256:	E19A99AC13A1A2A3CAE98B7382F59CA547E78B7CE84E807B8177F45B720DA650
SHA-512:	E119E130287A2AC723BDBD3D341149A77F4F76B1FA293747ADA89C02F6B9B3AD9BB29AF1F531B643F4F8896B22050499475AB85F66EAC76CFCB1C04D9B07EA67
Malicious:	false
Preview:	(.......oy retne........................d\.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlzt:Ls3z
MD5:	052A7E458CD23B777F1F88FC200DB476
SHA1:	33217D4FD712218ACC2C3897736F31583CC11549
SHA-256:	CDF806A2D17F245F064911D8B88E67150BEF8DC807436291A31DE0E206B91E0D
SHA-512:	87E8178890904CF4B5BEE4A2C17EC83219F2B97B41D30E296BABAAD4B6C8445565BC49EEDC563867ABB9EAC260DE8F754A12DBDFBFC29807C3E15CFA705DF63B
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl51NP+/:Ls3rNP
MD5:	AD47EA53B9CE09EC1093BA435843627B
SHA1:	1EA6AD1CB3A0692B93877F38979D5F71F7AF7653
SHA-256:	9FCB42AF7FA7BB9031C4942900B53785A266249C3786275CAA056363F1B791D2
SHA-512:	3E6FE2EDDBDF4C60120F24D5A1BD6B0FB7666693FEF55EB7ADEC5E3E2B8340BFB82381DEA7D2F5E3C6E38CEEF663D37D893198C9748D2E2B2FD56B991F5B4186
Malicious:	false
Preview:	........................................%..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.211148956180249
Encrypted:	false
SSDEEP:	6:P3a1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLll3haDAi+q2Pwkn23oH+Tcwt0jqEKjl:P3lfYebqqBvFLn3hIz+vYfYebqqBQFUv
MD5:	47AD3589EF48F88C15DB16D669BCC724
SHA1:	C8B4392A6759391C448A50DA012C91746C7A6119
SHA-256:	CC8B3A30C4CB9558A7F42E3A13FABD55F5E80EA17FD5DA2A703FBFEDE323D04C
SHA-512:	C96F7893BEC527CAF172276354921361E2D682866002788F170648EA7628B0BF6D5DDDCAE87D04A026895B823304CF64EDF9F4AF4F9EDB6B782A8A741E960A80
Malicious:	false
Preview:	2024/09/02-05:15:03.419 1fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/02-05:15:03.846 1fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\75e68809-a7a2-4e07-a16d-7da979a25e5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\91f6f26a-327f-4467-8e5f-e67b4652c06d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9658ed91-c629-4307-95aa-b4ef61345882.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3c6fa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cec1223a-05ba-4e17-94e4-bc7c5ef5fda2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.174254825469106
Encrypted:	false
SSDEEP:	6:P3PpB1wkn23oH+Tcwt0jqEKj0QM72KLll3PKz+q2Pwkn23oH+Tcwt0jqEKj0QMxh:P3RkfYebqqB6Ln3W+vYfYebqqBZFUv
MD5:	8AFE82EED1D2C177A196111AD19F63F0
SHA1:	AC59DF2EF1DEEDF29A8C211BD6DA411FE6D0C554
SHA-256:	7BE33D60FBD4EDB8F224425C9F66B4D179F44F50C4283371B86CFD8515D871EF
SHA-512:	EE9B96FB31B3AEABA8A0EBDE9F0F918E56872B0CED7B30F979324DA1DB0E7423B9136280FA4B385BCBA9F5C71FC4B5A12DF79A124C741850F7F46A373006C201
Malicious:	false
Preview:	2024/09/02-05:15:19.187 1fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/02-05:15:19.212 1fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.232402134015343
Encrypted:	false
SSDEEP:	6:P34Ahq1wkn23oH+Tcwtkx2KLll3r/L+q2Pwkn23oH+TcwtCIFUv:P34ALfYebkVLn3r/yvYfYebLFUv
MD5:	95A072EE375E812B84CFD548C4C8F244
SHA1:	870CE10D7A3F7316CF0CCEADDFE9919AC78F0A6D
SHA-256:	2DBBE422B638F27E8B2D7B2E36CCD88166888A6305D496602A0357314ACCCD3B
SHA-512:	E248490FE97E580BA95144947675F680E62FCE4F6C49C07A16A706F1FF3F02A91798F3FAA77FFF019320458C113791BC99A3ACE10D2932BD886E1F3757BF2FF8
Malicious:	false
Preview:	2024/09/02-05:15:01.586 1f18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/02-05:15:01.697 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVUHj/:IiVUH
MD5:	34F20FD1C92B9165739E3B1DA1A1B54D
SHA1:	A3C9131F0B6ECD1899247D2E28DA52D6BB3A2BF1
SHA-256:	0C925014009C267E0D26BE71EB695964DD643C607F43B30E3A5FAD89F800ED77
SHA-512:	AE3729A0059C64199D0FF921F975040F36F3EB39769A52940BB9D9998CEB4EFA58D658A1F981B4D64784B2518336C03AE091037BE662A6B7ACB91DD09D2CFFDE
Malicious:	false
Preview:	VLnk.....?......i.%..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0773521445417682
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkO1SAE+WslKOMq+vVumYbNn66:e/2qOB1nxCkO1SAELyKOMq+vVumap
MD5:	E6297455547D9F7DD60255D8E939E91C
SHA1:	A66CB4DC42206D0D58078FFA1DEF808A6B6AD0E6
SHA-256:	F2383DA2307AC5D5775F91333FF152EB36803990952001D9CD6E55CD28F99E7F
SHA-512:	6A73AB13E4C00798914D91D30E36325D9BAA2CDB148AD1D4DD8D6EE4ACDF60BE7FBC8B063107FF95876372C61D5FCF14F16879777862728C960E97EE885A02AA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\aba9003d-b8e5-447b-8e80-74f76b614fc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566157709923853
Encrypted:	false
SSDEEP:	768:X2+uZbwWPN1fMj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVspbOmrwnEepGtug:X2+uZbwWPN1fMju1ja9dOjn0t3
MD5:	718BEEF3DC69A6664197E1F071E9417C
SHA1:	6D7153EDFF214170BFDDF42AD2C32918D814DAB6
SHA-256:	B5171A40B7943497A64A61AD763A31A17976E8C4B33AA687DB6637EA4B8840BC
SHA-512:	7BC9ABFA95C55E54BC59E80BAE68CDE5EC42F9220D43A58788B5DE0CB544315A8C14CF245CB899EE468C886AA1FEAB8F67BC6B7A7559D309A466C01B55024AD3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742101583814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742101583814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\bdc86677-179a-4b6c-8f05-880a739409a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.974711570243269
Encrypted:	false
SSDEEP:	96:stQqfXis15Vb97l8kN8z24s85eh6Cb7/x+6MhmuecmAej+QP2Mz/EJ:stQFsDh8kNkNs88bV+FiAWPzMJ
MD5:	0117B9C0888E043D34A3FCE3F1ABF02E
SHA1:	0AC377AA92D7ED5CE551C7FF6D98F7F917EDDAA1
SHA-256:	B64E849796384B28CDD8979DD62C24EA0FD14E9BB9ED7517508DECD5F17E82EC
SHA-512:	F4DD99A48A958F5059945370D49C8EAE0A9ABA969A0807E82520E5BBB316771EB69C6630355E5CEAB7C8746EE1537B464BD146FD1283B9E72B87C63169F15DC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369742102123639","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369742102124314"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c1b388de-2736-4bbc-816a-6530b5b15260.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f500d998-e37a-4d9c-b27d-3a6f18e5d572.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/wMHlFll:7+/l/
MD5:	1ABF00CEEB005B4D04EB9DFDE64450FE
SHA1:	39F47870DA56FB1D623C122C662E1B143DD27EF4
SHA-256:	2199A8192EB42DAE3173029BCA4C9CE2AA6FFE881A9FA073771DE35A029BDCD8
SHA-512:	0B147825745FAD9C498627956775010D12EC1E0F34E3E875E8861973BCEE3E79A1B6A00BC470A1F77C635BB0D996585A6D93DCF803231867B6206ED56B77B3BF
Malicious:	false
Preview:	.... .c......fx_................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04947567353792732
Encrypted:	false
SSDEEP:	6:GLW0CKyVKpW0CKyVfML9X8hslotGLNl0ml/XoQDeX:aCQCuGEjVl/XoQ
MD5:	97E9C729D677292BE1C895CF88371769
SHA1:	4EE34F0B6997F387294347AB702B898F22814309
SHA-256:	53D21887E0ED7982688CAB210CAB3696A2074804E3BEA3ECD272E4D63EC87EDC
SHA-512:	622251FDF3CAE2ECC24734B43343EB65B90E9FB50B43CC350FD288BA579CC92A4BB33194C80B4FF9FB48ACEC19E1B73FFBB56E6EBD734A87DE79BFD14BFDA48B
Malicious:	false
Preview:	..-..............................S2'....C+.t......-..............................S2'....C+.t............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.998646410610915
Encrypted:	false
SSDEEP:	48:9YzxYmlO+vcbX+fBn9VAKAFXX+rQN2VAKAFXX+XxOqVAKAFXX+LnUYVAKAFXX+0D:9oxY+ZfqNsrQLNshO5Ns6Ns0D
MD5:	59B20A2A9145E719139A9DB370C9808C
SHA1:	3C4FED5150E45259DE69918B77B48F6A4B780ED8
SHA-256:	E89D7DCC817F3E754FF1EE276E6D7B360F36C628E5030D037357689E636516FC
SHA-512:	9B60C2809219DBDBBDD6D1730572808BF78F2E1516E0E147E6939181FA867AAB48BE104B3F688BC8B008E0D0AB37BC614335340E0D51CB8D5D4C62AA5D0A6D52
Malicious:	false
Preview:	7....-...........S2'......V.............S2'.....g.....bSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.501809923997352
Encrypted:	false
SSDEEP:	48:zK8tSBS2QoCPEHRHyxQIYjIYqz6qknMYjMYRyBAlkfAlk33:zM02QojIYjIYqz6bnMYjMYWYcY63
MD5:	DBB3A7EA63C610C09903E6673030BEB6
SHA1:	E3C341982F88BD64EA64D4FA2D1052D423EF8480
SHA-256:	D23B4E55B3D79227CC5891D0CB7715FC006C49B9AFB0B0952CAF89AD1B5DEDA9
SHA-512:	B89F1E75B1E6CADCF4C20D1F4131F653E879E33403580BA077E2C2B833B37D343E91FB48509605BD497F17CBBBF10D9C13F3801951EFC8CFBFB3F887F7FB88A7
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.=97.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.239202320534775
Encrypted:	false
SSDEEP:	6:P3x+q1wkn23oH+Tcwt0rl2KLll3x4q2Pwkn23oH+Tcwt0rK+IFUv:P3x+1fYebeLn3SvYfYeb13FUv
MD5:	7FAAC55289313A61A9EF5527C10D2F85
SHA1:	DDC7D22A6F6C507B104FF37985CD4BC3A9796509
SHA-256:	DC7B711C2BBBBB3BB5F8A2115DD1E771CE36970C7E0988C4331AB6BF606FA7A6
SHA-512:	63FA32733E8784AC82E8A41CE7CEEB1AA292D75E62FC35D1AB8CDF9F83C1007280F0B7B7127414C9D8C7EC13A1F27B3225A5685E47B22F1B318CDD6726547321
Malicious:	false
Preview:	2024/09/02-05:15:03.268 1ed0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/02-05:15:03.277 1ed0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.936066472671406
Encrypted:	false
SSDEEP:	12:G0nYUteza//z3AwZd75+it/6WlJhC+lvBpt2FsdPLQtRuARW:G0nYUtezaD3AwHEijvhC+lvBxQtg
MD5:	E51ABD9CDC3565BAEDF542D78D5E0C7E
SHA1:	EA2AD4BBEDCD5FD4AEA088BAABE26C99EDB1C6A3
SHA-256:	35101659337C51F3E4CE5F2DA5313497A75DD9043D4E3D93E48C877CE5783F0D
SHA-512:	6B76BACA2D4D212FD1904C53A99255B41BFC246FC2701974243FE26D73BAD847789E8A79CAC32F9285704141951A9E5BFBC6A4814498A65E8362BF2A01A9C2A4
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....L....................3_.....Z..+.................4_..........................18_.........................37_........].................20_.....Owa..................20_.....`..N.................19_.....7*X..................3_.....X....................4_......(...................18_.....I.Ha.................37_......Q...................38_..........................39_..........................38_........x.................9_.....LZa..................39_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.196677413822827
Encrypted:	false
SSDEEP:	6:P3G8q1wkn23oH+Tcwt0rzs52KLll3xokVF34q2Pwkn23oH+Tcwt0rzAdIFUv:P3n1fYeb99Ln3xokVOvYfYebyFUv
MD5:	704EE29E9E276F84C27F7BF65253756B
SHA1:	E893EE95934E7D8C9F00DBA3741A4C27E106776F
SHA-256:	D9FCA91C990E3009C8C0D5424CB35CF9B5DF3E3B5E135C0F7AEDCCB5C2D1F22F
SHA-512:	D03044383401CB47C3436030359C581EE6814FEDBDD7841BEA17D98FADA459CA0403A8F50DB52DFFAB5B28AF3F4C588D383E05383987476E6F1AF655AE4287CA
Malicious:	false
Preview:	2024/09/02-05:15:02.987 1ed0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/02-05:15:03.264 1ed0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlXq0/l:Ls3B/
MD5:	3288D3910F45CA453170308EEC1F0398
SHA1:	E4CB2F1EEE2740349DFA2CF876A530B883EC0F0F
SHA-256:	40AC4A5CE30E3CAAC8901200074A1B745D87E6B61F19B733C601DBCBBA9E9569
SHA-512:	C305C405D7115546711AC614F04F250B820C268DFEC09F5BF26070D659D8CD063A40AC2F3918D674761AB7C862384DBC5ED9AD7EE8CBFD1E1D8719140EA74FBF
Malicious:	false
Preview:	............................................/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlSu:Ls3
MD5:	A960FFEFC2F7D65CD1D8572650FDF01D
SHA1:	5EB9CB752648D51C70E8362F7F2A10930939B7AE
SHA-256:	CA08738E030675B7B3CDABF54B7CE89FA752F15C4905016AD9647089A39FC352
SHA-512:	81382C9F4E0E092E62BB59ED71CCC9FB520564A1113FDFF35341C6F1FC6F7AB3BB72A0A316ADED8103D7FDD8E154D649E05C03103E1E82079C67B5D785D0E0E5
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29acf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29cb3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29cf2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c411.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2fe8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3512e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF38677.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3ada6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF40cfc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.54530263019881
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtd0ypXJMqjkdmyikKJdXBuBuwBeaQt4rNh5Hb3XcQQRCYfYg:YuBqDPafL0yHMmhRgBzBexyPhb3RB0
MD5:	B29F7E2A752D4A0FF40D9B3493A17653
SHA1:	421315FA76A4D9D5B4DC2551167A7D3AD6CE14D7
SHA-256:	C01F8E9649BD582331599045EC8869735684F900AF2258EDA49D7CA965CB714B
SHA-512:	5D802CE78AE5465CADB7EB04D08444E9E3BB514B5DFCD641CCF6CDD0CCBB778AFD54CD6E35FA3A98DFB445BACFB092A1975A4058005C1DEF91DA71CC543BEA42
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369742100979796","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725268500"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlJ2/:Ls3J
MD5:	38721AC2D056E109E89094FF5AE8E3DD
SHA1:	6F5106F52E72B935C04398D08F5C595E526DC559
SHA-256:	626E0121CC39FD1A1AD3D6A401D9237614607C3FEE427C9EF7BEDD621B91D88B
SHA-512:	02D42EC7BED91291E71C5422D7DD8190F60C8E455037D3BD32779B16691DD5FA4A52B2FDBAC028F725B276C30AEBFCBD33CDCF82F483BB84D05E963A022BBF62
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\bca4f4bf-7de1-4d60-b6a0-eb988825f9b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.588166719417341
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afL0yHMm+RkHB+pdrxNvBexyAZfRbbCaJkXSc26wlRIOB0:Xq8NkC1fgyHN+IBuPvkxyWZ3rJkCcCLq
MD5:	2C6F4C65E98C598D6DEB245AC248141E
SHA1:	BA6AFBBC9B6BBCA62DC1440CF1DE88A9EBE3F15F
SHA-256:	94B3B6CE3D8219C3A2BBD8A3A2D384A1062F0E7F61A91D58EE7A0A1B186F35AD
SHA-512:	496E9C27B52C83DA4557E9CF27AEE1D3D3D918CF0745A3D45006D978FDDE81A4018D2074E5FD6CAD458F8AB1115F7526E876028847A2F2CC93CE9B72491827D0
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"policy":{"last_statistics_update":"13369742101030991"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\cd0247eb-696c-4b44-beb0-82eb69f6de97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.61265055596902
Encrypted:	false
SSDEEP:	96:0q8NkC1fgyHN+WBBuPvkxyvZWIJkCc/SDS4S4SDSteI4a:/8NbGu/ByBWokCbL
MD5:	724D0C45015E79D6DBC120AF9DD71226
SHA1:	0BDF12F706F4E08F15112DD65B11A3892603A77C
SHA-256:	BDFBBEAC6EDC22CE85F10863A0D6AACC150CC4BA421CAF5938ED0FFEDE2466F4
SHA-512:	E9D0C6DC159747DC99CC1E878C5CB5F26D3E5EEF509995D179636B20E3B758D23949376226F357E961742B7807DF0567EED729E28E6CCA717F7E1807796EBA20
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81FvsncqXvg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\cd3bba54-4f36-49c2-aa8c-0143ba0aad93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24321
Entropy (8bit):	6.055376287393544
Encrypted:	false
SSDEEP:	384:WtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NlME/9yyOBqdpVEKzX9jcPoCvScdWFDVb:aMGQ7FCYXGIgtDAWtJ4nn8fOHKzX9jcG
MD5:	F83AF8F114D20A578862085DF6C0D690
SHA1:	F850B18AA72123AA2537D95B1CB0AFF27B2B0470
SHA-256:	EA7409CD673C12B13965327E2F4240967150FB950720DB8CD11B9D3E62B098A7
SHA-512:	637268C66EFCD761BF03B5A96D9B21B625C33B35608A19438685B2C1A94DD4A71FD2F83231E3C75BE0AB7C9A2F2D86741F4AD797DAF2DF3A7402DC40B42CFF58
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742103208775","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ed0ff309-9862-4f88-bfb8-b3953f6a9124.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21006
Entropy (8bit):	6.066075467506377
Encrypted:	false
SSDEEP:	384:WtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSME/9QyBzCbyCvScdWFDVNMa2w:aMGQ7FCYXGIgtDAWtJ4no8RBzCOCvYDV
MD5:	21E82C674DE13B50D12E753255CB5631
SHA1:	825E60E10279E9C9C79CFB94D115DD25BE35799F
SHA-256:	91613F8405B741FE298B9AF71A62211504DCB1356674DA07160F00B7E5713C82
SHA-512:	6A89F515FBF53749419B6A314EA15C5FC7C9B0E990F48D41C43697A40FEC201815E80C1FF91E0F44C615D8DD6F73E5EF906D27C80217F3CD7275416D54A74410
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742103208775","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f3185cb0-0a93-4b66-bd32-31d0cdc9026b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21006
Entropy (8bit):	6.066061477668487
Encrypted:	false
SSDEEP:	384:WtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSMJ/9QyBzCbyCvScdWFDVNMa2w:aMGQ7FCYXGIgtDAWtJ4no9RBzCOCvYDV
MD5:	707725C465AF6DFA948C57C9B8FCA6CC
SHA1:	398A5B81071D97C8525246F1B6D62B8F601B01CB
SHA-256:	5387C07018CE13F0BE614121488D976504E29586088C32C7B2268716F7FAB043
SHA-512:	646D9BE7940FBC422A447076C3C9D854D2CA6D4AF5121A191D8E4E2E02BCB46334258C48C4D911176474B97FF6DEF0ACE361D1DB396B18EB23ACCC2BB0206D8B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742103208775","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f7b0c5e2-54b3-431d-a435-d0090cff75b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.498005975388241
Encrypted:	false
SSDEEP:	96:0q8NkGS1fgyHN+58rh/cI9URoDotojLBuPvkxyvZWIJkCc/SDS4S4SDSteI4a:/8NBSGuReoDUWByBWokCbL
MD5:	28C135997228C4AC33A0EAD3204D4BD2
SHA1:	2C9470C8959BD9D8AC9B7B37C23D5D474CA4EB3D
SHA-256:	9FBE365AC33454F26824882AD753E0A2713C1A88037631892A9E0983C5ECC366
SHA-512:	F761363D0A4F732550935C27A6E9A2918B4D65ED3EE4C71E64E869ADB84B374D1FBA22ACCD90C78D7290BA50CA9EB8DC4DFE7AD7D1374781466DED23D824CDF0
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC/x+pJFtVS4W6z0cRxPq6vkBLnGciEk89ru7+5mRDmHwAAAAAOgAAAAAIAACAAAADcEFOdTvOSNZB0Wi9frgA6KV1RKQtl3X3/Zn/d3T89VzAAAAAusNhbK3b2xDKgIkth7Gm9m+88NfK+vCbRK4bKIecqli/l6U+I2qYnaODfya434nRAAAAAzYO4avrjB/pPy39x8ftiZ8HnGKx489qJZojXHHYBm9JH8xaXxbb0ruwx22a7tIYG1IWBLl2YQAI81Fvsn

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\14891e1d-dd78-46a6-969c-f88bac18d6f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60131
Entropy (8bit):	6.081612102808985
Encrypted:	false
SSDEEP:	1536:AMGQ5XMBGPaf8dP0Sf3H5WFDnOaZA4j0b+CYz1X:AMrJM8CkdP0Sf394QRYz1X
MD5:	CEC186FF99AF08B40C7842D3AC79A3DC
SHA1:	07CC28E692B8BF91AEE551859AE8D35676F07680
SHA-256:	6DFBC58594D4A2A46D92CFB0774F1CC563961B3695BD7171B47F6E4071F25868
SHA-512:	12BE991A16EC1DC6B35A1266581935C3E35B6A323F8D267BBBAB66541CDE6F7D3E82C36AEAEF1D35F788D1A1E90B0157124B9097B97EC2495C1A4CEF6E0E89F8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742116893072","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1760390d-7eee-4928-b27c-1e9a5048f27f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.059153833069385
Encrypted:	false
SSDEEP:	384:gtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwRA9+PCO+Mh0lkdHd5qE:AMGQ7FCYXGIgtDAWtJ4ndo+PCGh02tdP
MD5:	B8F1DEC249145C07BC57FFEF2C2B4DF8
SHA1:	14667DA3D538277EF7CAA4CCDD7EC56AD678F8DA
SHA-256:	87D21255E29A0109EAD2201D253FBF3EA7674BA36B2D4937CB8F8955A21A0C79
SHA-512:	27865C03D9CF137A7D2A6FC037220644F6C23E6EF877E3CD8775BE7BBED75A10DF50E8CBBE1CF8A3A12229DCD64539D64053ABD4C2EB9CCB046879EB33A1251F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742116893072","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1bab2116-66bb-4807-bcf6-0bf85099d172.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.8334960546139865
Encrypted:	false
SSDEEP:	192:fsNw4aeiRU2c1nQ5OySkC+96qRAq1k8SPxVLZ7VTiB:fsNwVPcQ51RC+96q3QxVNZTiB
MD5:	2D8902F459BD35EDAD9E085A4D22AE49
SHA1:	842B72D58DDCCB3864237627ED072B86B439195F
SHA-256:	9F91C951AB7ED10CA8CAFF0B7BED21F1AABD688732886B04093FF4C33FC43177
SHA-512:	7AC3742B9BB7C404BB2AEAE3BAB237A8EE0CF6CA3773764416E4C29495691BBE48555CA4CB143682189A6FCFA1618EEDE22C3ECB9E12A155E27F20E8C4FF86FA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\397c462f-4622-4991-bd9f-05521c919c34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\51a01a4a-b8d5-4bd2-b8c3-81c4a2fc63b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.801344224487415
Encrypted:	false
SSDEEP:	192:fsNw4aeiRU2/Q0kCn6qRAq1k8SPxVLZ7VTiQ:fsNwVPYPCn6q3QxVNZTiQ
MD5:	38B88327E0C612804874B6A4EBDA50C6
SHA1:	920FECC4D3B6261BC7FF76B34962D6B2C59EA754
SHA-256:	8E487B75374A557413377258D9C90AD3BBA1C3D57A28D330C73AACBB478BC529
SHA-512:	31B5A4F1BCB135E015EC8CC2CB3704ED898BD62F1EBAAABB8FABFE090D425503501927A27622F56A4462448DE9198AC802DA4C5ED26333E1B7894498AB04488E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\72eaff22-65cd-49a5-938b-7e1a368bb13b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24701
Entropy (8bit):	6.053671470918347
Encrypted:	false
SSDEEP:	768:AMGQ7FCYXGIgtDAWtJ4nsoXeYzLkh02tdP:AMGQ5XMBG0YzsX
MD5:	D5CDEA18ABB297CE0D9F3091B2BA833F
SHA1:	1BFBA47BD8F3E7469EDBF9908855C5968852EDB2
SHA-256:	5A17C87367CAD16FE72ABA4323CD114606AF2392D68E8D5B39D7FE250569136B
SHA-512:	4C135519E32077FBF6F251C9568971C25602B182ADC3ACBC40F1989714C68D973C3744EB1397A031D9FBC44296DADF3779DE2B76AECF092C9CC5B757A9765228
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742116893072","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\82e88224-206c-4ea2-ab95-3610a2f06ab1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.83345080438503
Encrypted:	false
SSDEEP:	192:fsNw4aeiRU2c1nQ5/1RkC+96qRAq1k8SPxVLZ7VTiB:fsNwVPcQ59CC+96q3QxVNZTiB
MD5:	EB3280171BA100322C9396F3804A73E7
SHA1:	A8D438DB95F28166846600C854564F2B40DFC19E
SHA-256:	D2CE829A9FD4C58C6C65E8DEE3207510C50F39B16AC56C8A876D7B8B8EE62806
SHA-512:	89CE21FA0F0FCB2D99F2F695C7D6C11B8E816039352F7226EA856E0EE24D90D81BF57A91EEA0DAF6CCB8671A079DC02344FBB10A18192C5DD346DC6B97B6009E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\852d83b1-0954-493e-aa56-8e66f94a5068.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.83345080438503
Encrypted:	false
SSDEEP:	192:fsNw4aeiRU2c1nQ5/1RkC+96qRAq1k8SPxVLZ7VTiB:fsNwVPcQ59CC+96q3QxVNZTiB
MD5:	EB3280171BA100322C9396F3804A73E7
SHA1:	A8D438DB95F28166846600C854564F2B40DFC19E
SHA-256:	D2CE829A9FD4C58C6C65E8DEE3207510C50F39B16AC56C8A876D7B8B8EE62806
SHA-512:	89CE21FA0F0FCB2D99F2F695C7D6C11B8E816039352F7226EA856E0EE24D90D81BF57A91EEA0DAF6CCB8671A079DC02344FBB10A18192C5DD346DC6B97B6009E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d7c5e4d-7652-433c-a125-c45eeaf85403.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.807651800690902
Encrypted:	false
SSDEEP:	192:fsNA4aeiRUF/Q0kCn6qRAq1k8SPxVLZ7VTiQ:fsNAVmYPCn6q3QxVNZTiQ
MD5:	2D7AB875962231505A89DBA62859A192
SHA1:	D98086F146DB9250FCCAD3D1FC219633F4FB2299
SHA-256:	AE169F8862C9ED918AAE01EEEE9F586B1BC20428C3BA3B69F004C7ED4595622A
SHA-512:	9A1160E8E9FBAD85059065F15FFBB6ED1EB1B8F65D20467367A2766DE45175485997D4AEE371E103414A619BF14562E614DDDC116523FBFCE2C5DA858922AEC0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d18a6a07-befa-43b2-818c-38dbdf3cd373.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D58224-2020.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 2048.062500, slope 17753217332035315519916605440.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.31350451675927665
Encrypted:	false
SSDEEP:	3072:z57otU+5EqBIMIWPs/RtxePbAnDpkVgrEQPE3pTFQ8IeO3EGNIMqSvDbrfdAbgQ5:eLiGODpBrEZ5gQEaH4GZR
MD5:	40AC7FA921ED35F95CA92E8FAF264C17
SHA1:	AA84065955F1ECED09293E82F8F86BBAB9E89A1E
SHA-256:	80020DE2190F9C0845340813114ABE62E4970FC53CD3562636EEA00FEA7FE047
SHA-512:	4C3EC5846E5C443B64435A759B0A33A4A0AF6EB8BA9E337686DEF8C478DAB0606AAC589F9E468EEE6106E193604D5C51D532143808206D95FF861B5FA44A7AD2
Malicious:	false
Preview:	...@..@...@.....C.].....@................T...S..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".yhiwlf20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D5822C-2740.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039751933263235326
Encrypted:	false
SSDEEP:	192:lQ0EbtmqvDtKX7EJEa3XxxTVwg7X8iV0DA5DhAVN/K+aX1gQMVisq01n8y08TcmQ:G0Et/eQtZnhUHEgxisX108T2RGOD
MD5:	EFFACD65C4F9763CD7FBA359A4EB0806
SHA1:	881B32F2BA55A086405D94B9A3C92D1720711B93
SHA-256:	F396FC73AAEFA458839A541CF17564556E1673624827F31A4CD9F6A630A40D19
SHA-512:	510134AF4BA87409A83A3DDD589B050C9195CFFB0CA42F96F062AFA9432EC7E3109709674669DFF31B1BA7CA589C5DA75E02192F488A31DC4BEB08AEE3DC433F
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yhiwlf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D58234-808.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038830273052615064
Encrypted:	false
SSDEEP:	192:Of0EbtmqvD3KX7xJEa3Xxx7UpXxgg6zfhj1NErZGtxP1gQM2tpuxq2n8y08Tcm2D:e0Et4eZVQh5WWDgwpuh08T2RGOD
MD5:	5BECA9D26AB7F37C0FFF35297CB528B6
SHA1:	B4F1DB7FDAC36D7B451F70E9CD28129C624323A8
SHA-256:	150C9B27989B8C488307FD7E897A3C98750D348BA32DF96FF05653417795ECD9
SHA-512:	E4697C1E6A7E7523BFB5E05575DB774F3BB3FA9980C4D5F4B3B2CE77528F971F2E7F8C7464B4B5CE6CA651649D8F5B0CE5AB6767C867EDE46982604BFF57D8F2
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yhiwlf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D58241-139C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882513578199388
Encrypted:	false
SSDEEP:	192:O00EbtmqvD3KX7nJEa3Xxx7UpXxgg6zfhj1NEzqfW1gQc3A+dgq2n8y08Tcm2RGY:h0EtyeZVQh5hygzAnh08T2RGOD
MD5:	1987683DAF237D3F41B4B7AC2F46580B
SHA1:	D8544ECE76D51FB7A011BA835EB91FC67F0D2143
SHA-256:	138A131174852378A8EDBC6ADE20224505B0DFF6D1AB5FB5F552C71782964A49
SHA-512:	D878B2356D4F53AFE569A4475C82E7911DF8D2FBC93C7B5928DEE14D39853E1A3AFA4333B7A4270DA35171DB5BE0F888C0FD99B4244E2D5DB88543EBA62DB580
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yhiwlf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\04011a0a-2ec3-4183-a314-a13b83006e5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.189242841889216
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjwhhFNUifY5sY5Th6Cp9/x+6M8muecmAeCoue4zvrN/:sVnRJkAKxkEPuwY5sYPpj+FVAzNFBf
MD5:	453C993AB6C2DDBB789E5ADD3D0F2B66
SHA1:	146F43CDC1091E0EB340A4153B0B389E7AAA881E
SHA-256:	C6CC3FF4DDC86541DF4F6CE65AD9F8A1CB4F6172C3234A82BA24876B890479A3
SHA-512:	11C6FC5725D0E97B2B9DA4F074DB9C58D22B13F0A30F9C68E5AAF932668B9D23FD58D0804F42FB99A96C97F21E837FAA74DCDD7FE02EAEF3C206C89A66017A9E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\227e0454-30e7-45d3-bfbf-bff4eb54fa0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4b69f590-37fe-4191-acf3-1ee6d4aa726f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557647269097734
Encrypted:	false
SSDEEP:	768:DeBYetd7pLGLv7WWPQKfAH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0J4JCrw8DcpUU:DeBYetLcv7WWPQKfAHu1jaBCJnHtL
MD5:	ACB822E02FD18BD947FD9637B1C9FE5A
SHA1:	CDA1C8260A7677D5ADFD901CD3E7BA6379FF6467
SHA-256:	AE7ACDB8D59C68CCE9848A3ABCDE0BA7E7EC9B11903874D4423A32DDDC2981C1
SHA-512:	45B71F033FD2995177907661523A0096E1802A3ECC31F7A314F1B509796DBE70ED3361BC82DF8235576F2D583915391AFC4A8B072F2C0E4C425FFE918BA541F9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742116671982","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742116671982","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\598368e9-a744-41d7-9523-7578815272b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8702
Entropy (8bit):	5.074297105843277
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjyY5sY5Th6Cp9/x+6M8muecmAeCoue4zvrN2X6gE5Ak:sVnRJkAKxkyY5sYPpj+FVAzNFBf
MD5:	0CA702E6B0015C3595E2EA2819C1CB8C
SHA1:	B87F9E43D0D45D54D82DEF3191A62B43ACC270E5
SHA-256:	D8E168F625E8B4121D097FA4E7FCC4EF788CF560B9CCC7372E3B16B5633D7A14
SHA-512:	577699734ED57995950DA72B32D3C9D9D7028428CE7AB69E574310EBEA16A35C95B041549730B62FDD063918516BC413FCB7CA332E70E0EE822AA9EDE513A162
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\665cf0d3-e332-4483-855e-4c10dc55e049.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28367
Entropy (8bit):	5.557879800023175
Encrypted:	false
SSDEEP:	768:DeBYetd7pLGLv7WWPQKfnH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0J4JCrwtDcpUX:DeBYetLcv7WWPQKfnHu1jaBCJnKtM
MD5:	58CF57B025F2D998EE76C544195E0031
SHA1:	3DAB0274EE45C7F434F6A471EF88EC52F3864C52
SHA-256:	BA40373A35D6220B579521CA012DEDBCD1E3D62F8264CD495514FB623846EA61
SHA-512:	9AD2E299A870A79DACAB828CCC4A5F138110C04D611BEC41A6CC4DBD83ED7974DD1EE845FA78BC1F6F406D143900CEC79E3D747CB80B8CD5F6547C655D67FA78
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742116671982","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742116671982","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\716ae949-10f6-4c23-a7f7-59f31b42ee5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.187890403433028
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjwhhFNUifY5sY5Th6Cp9/x+6M8muecmAeCWue4zvrN/:sVnRJkAKxkEPuwY5sYPpj+FVA9NFBf
MD5:	45ED22E2E5FAA6D90C62A647E5944B7A
SHA1:	C12DD859D35DA8FF5A01EAF6BE6B6ECF9BB373A7
SHA-256:	2368813261C92FAC0EFA71EA27E144CDEE1AC0CAD2924EC56C9F5521D684EA8F
SHA-512:	FD2516265D4E33A644E53E2AC49B6662D2F07F68A518752B2429ED92FF5FC4F3E4DE19E221900F562B8A771061C05AE26BBF4B1F624746726BD4BDFF14F77434
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9c44ea1c-0c33-4fe0-aa14-257ead4923b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320463893640151
Encrypted:	false
SSDEEP:	192:XAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:QOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	58FE234C1FF54D6FBE155B11A21F7CA8
SHA1:	8DA3BB1C4825785B91155BB73A5F763E18DAF411
SHA-256:	8C499ABD9A6CDD6B24F3B9268C51181B567B3783E54D0DA61AE90A9B63DFCDCD
SHA-512:	6340AAE918FC500AF39A5FDE0DD4B0FEEAAA64F2A0DC1C9EB29CF183DCDA83EF00C22FEC8B1256230E1A4EA4B2A8A05569E04AC89252E171EE3419F25A04FD7D
Malicious:	false
Preview:	...m.................DB_VERSION.10n...................QUERY_TIMESTAMP:arbitration_priority_list4...13369742118694237.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.091987153262987
Encrypted:	false
SSDEEP:	6:P3PRcCFm81wkn23oH+Tcwt9Eh1ZB2KLll3P0dOq2Pwkn23oH+Tcwt9Eh1tIFUv:P3pcCcbfYeb9Eh1ZFLn3NvYfYeb9Eh1b
MD5:	3F50C5AF8C241A6D1DFD8E747ECD31C5
SHA1:	A2E8F77E641129713C659FEDF5FE31A411A8DA5D
SHA-256:	BCE5BDAF9FD69FDA1FAB52B60D312D3AE01E758FACBE0660A2D7CE02E79C1808
SHA-512:	609903A3934D20FAF80F3E828CDD7F8729467D07BD0EB4D059B0681B4AC720FCF334E594897A24BF46E3B838358697992CC36E55A299397C58A576B65FCBAA55
Malicious:	false
Preview:	2024/09/02-05:15:17.996 a80 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/02-05:15:18.059 a80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYI2l:Ls3YI
MD5:	F2A27D8DCC274A990338D226BB8557E7
SHA1:	12A4BEC38BF75E12FB5DF633720C14824FF30877
SHA-256:	361BCF82E48680F4727FA0B2B6A60D886B934977DDA6A74B080A247618E2F480
SHA-512:	53B3BC1DFC6DA05C5A640F55178FFB0E072F2985780BA73B8F43D5E830F95505EF1B81A1EF2B327F40BA621517DA3EE0D9A9BE1BB2B88C000D56F714A20EAA4F
Malicious:	false
Preview:	........................................D...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.216617263276143
Encrypted:	false
SSDEEP:	6:P3PCTu2FB1wkn23oH+TcwtnG2tbB2KLll3PGbjM+q2Pwkn23oH+TcwtnG2tMsIF2:P36apfYebn9VFLn3ubjM+vYfYebn9GF2
MD5:	A5F094CFC5B94C30427E254E4E4F803B
SHA1:	F2FF93C10C3BDE07825B9B128CD662F7A13AF54B
SHA-256:	928C85655F06B387B61BAD33FB1FFE2AC6950408C9A47B91D7808664BA969EE7
SHA-512:	F9FB60D8384546C499A8421C57F3162D38D243A353A9331BBC718805F01DD9A71FFEE24CB2B89B8DCC1DD2D647091ECB1D7232BBE9040FB2645DE3439C5B4078
Malicious:	false
Preview:	2024/09/02-05:15:16.746 1d8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/02-05:15:16.921 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.189780879210667
Encrypted:	false
SSDEEP:	6:P3PzM1wkn23oH+Tcwt8aVdg2KLll3P3q2Pwkn23oH+Tcwt8aPrqIFUv:P3LrfYeb0Ln3fvYfYebL3FUv
MD5:	66DE93A213E522F91BF6CB66BEA28627
SHA1:	1D60E24B869BA94DF5A28C10F93CB51B7EEC658F
SHA-256:	447CAA1801093BF683C6233C1819AD45D662B4C14FD0084FACB1D043C9CD28C4
SHA-512:	F09F137B16A32451D0A54A51ACE37D8A5B82CD567D50B35FE07F7D66C6F8B8B2FA1FDC01521F7CEF512A98CE3E466E2B28BB035963E3DF28AED44F0FB981F931
Malicious:	false
Preview:	2024/09/02-05:15:16.752 1c34 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/02-05:15:16.916 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.137003551307906
Encrypted:	false
SSDEEP:	6:P3PAlxRM1wkn23oH+Tcwt86FB2KLll3P0EOq2Pwkn23oH+Tcwt865IFUv:P38rfYeb/FFLn3c1vYfYeb/WFUv
MD5:	536B936C2CC56F6616F1BA57C3D84CC4
SHA1:	CAA5576EAF11FFA8A5135F78F9ACC8CC98E175CA
SHA-256:	DCAE92F2CC030B9D51109CE9BFE810323465787EE9FA3B93CF7BF2A04BFF463E
SHA-512:	513CCB8CFCFB281A8D2A1F0AB740FDF65F8C597849B4AECED61E6FF8220E6F14BB1896843A5E2F03AC0B78C436A3DC958C803B0E3394E1E3965646294358AF00
Malicious:	false
Preview:	2024/09/02-05:15:16.941 154 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/02-05:15:17.005 154 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.135014780660509
Encrypted:	false
SSDEEP:	6:P3Piq2Pwkn23oH+Tcwt8NIFUt823PrZmw+23PhkwOwkn23oH+Tcwt8+eLJ:P3KvYfYebpFUt823D/+23Z5JfYebqJ
MD5:	CF46BCFE7D5B4491846AC367ADD392CB
SHA1:	7E0EB425A29232B5908E8A50188CB4046224BE93
SHA-256:	D5EC7678F8BC126543CF57655EAB831D630384C37DF5707A2C39E2230D754513
SHA-512:	074F150CCF104E8A69C5AC11050C3E9F0D71705D637337E2CA4BDD3CDAC6AB63231960992FDFBC9614A12737E5B0673D57E2369E2370946787C194E371EDD2CA
Malicious:	false
Preview:	2024/09/02-05:15:17.012 154 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/02-05:15:17.012 154 Recovering log #3.2024/09/02-05:15:17.012 154 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.135014780660509
Encrypted:	false
SSDEEP:	6:P3Piq2Pwkn23oH+Tcwt8NIFUt823PrZmw+23PhkwOwkn23oH+Tcwt8+eLJ:P3KvYfYebpFUt823D/+23Z5JfYebqJ
MD5:	CF46BCFE7D5B4491846AC367ADD392CB
SHA1:	7E0EB425A29232B5908E8A50188CB4046224BE93
SHA-256:	D5EC7678F8BC126543CF57655EAB831D630384C37DF5707A2C39E2230D754513
SHA-512:	074F150CCF104E8A69C5AC11050C3E9F0D71705D637337E2CA4BDD3CDAC6AB63231960992FDFBC9614A12737E5B0673D57E2369E2370946787C194E371EDD2CA
Malicious:	false
Preview:	2024/09/02-05:15:17.012 154 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/02-05:15:17.012 154 Recovering log #3.2024/09/02-05:15:17.012 154 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32761642864732426
Encrypted:	false
SSDEEP:	6:gFA/J3+t76Y4QZZofU99pO0BYZTqR4EZY4QZvGdn:gWhHQws9LdZBQZGd
MD5:	E9A09BBB4E4465FD841E9F266F7CDE00
SHA1:	3F9B7FFF8DD6F8D1FEFDEB146B234A93A60CF1BE
SHA-256:	A9A223C2DAC35C0AD6FB5D8EFB6C5405F5AE8CE86D66BE372E4E452E01E1F8A6
SHA-512:	75AA862512763DB2E20DD21CF0AF8793523825A0432938E724E9A79BA288E75650B8960D19DFAD8568637B09EC7B29768E87A59160E4E2E8EEB556AA2A807997
Malicious:	false
Preview:	............#b.....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.29133877509772
Encrypted:	false
SSDEEP:	12:P3j+vYfYeb8rcHEZrELFUt823A/+23wV5JfYeb8rcHEZrEZSJ:PAYfYeb8nZrExg8WEyJfYeb8nZrEZe
MD5:	F0ACA71CF07C31291AAA61D62400666F
SHA1:	E52DDED19AF484CA02897189346B3E9EE47F8204
SHA-256:	B4DF3EA583604D7E1396CA6FB71CD51B309A870087C2BDA3D62ACA5EA88DE4E8
SHA-512:	1F8C776F4568AEB850878A084734885120E8C0C3FE2542FCFC915AB38F6AAC56E19DE4B65027C6BFF932014C8D24D2BF1D89BBD5553FE4429B1C1C29FAC8A48D
Malicious:	false
Preview:	2024/09/02-05:15:17.682 21ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/02-05:15:17.683 21ac Recovering log #3.2024/09/02-05:15:17.683 21ac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.29133877509772
Encrypted:	false
SSDEEP:	12:P3j+vYfYeb8rcHEZrELFUt823A/+23wV5JfYeb8rcHEZrEZSJ:PAYfYeb8nZrExg8WEyJfYeb8nZrEZe
MD5:	F0ACA71CF07C31291AAA61D62400666F
SHA1:	E52DDED19AF484CA02897189346B3E9EE47F8204
SHA-256:	B4DF3EA583604D7E1396CA6FB71CD51B309A870087C2BDA3D62ACA5EA88DE4E8
SHA-512:	1F8C776F4568AEB850878A084734885120E8C0C3FE2542FCFC915AB38F6AAC56E19DE4B65027C6BFF932014C8D24D2BF1D89BBD5553FE4429B1C1C29FAC8A48D
Malicious:	false
Preview:	2024/09/02-05:15:17.682 21ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/02-05:15:17.683 21ac Recovering log #3.2024/09/02-05:15:17.683 21ac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.210125151000766
Encrypted:	false
SSDEEP:	6:P3Pcq2Pwkn23oH+Tcwt8a2jMGIFUt823P3AZmw+23P5X8zkwOwkn23oH+Tcwt8as:P3UvYfYeb8EFUt8234/+23hsz5JfYebw
MD5:	2A7E0F83474A2A944E855DE7410DF096
SHA1:	834570937AAF509922B373C5F54AA98B93CC3370
SHA-256:	9D6B40C1B18BA9BF7EB8AC67B9DAAC41F2F30E7D47BAE2AF3EE9AB5F886F7C34
SHA-512:	FE4AED8003F6AAB058377C7F6363C241827B5410422D3EF9501952E621F2BB32C2BDF47F44983D5E51277B97EFA1730680BA584B6FCD80FC2EE9B93F2A51F1F1
Malicious:	false
Preview:	2024/09/02-05:15:17.275 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/02-05:15:17.276 23b4 Recovering log #3.2024/09/02-05:15:17.278 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.210125151000766
Encrypted:	false
SSDEEP:	6:P3Pcq2Pwkn23oH+Tcwt8a2jMGIFUt823P3AZmw+23P5X8zkwOwkn23oH+Tcwt8as:P3UvYfYeb8EFUt8234/+23hsz5JfYebw
MD5:	2A7E0F83474A2A944E855DE7410DF096
SHA1:	834570937AAF509922B373C5F54AA98B93CC3370
SHA-256:	9D6B40C1B18BA9BF7EB8AC67B9DAAC41F2F30E7D47BAE2AF3EE9AB5F886F7C34
SHA-512:	FE4AED8003F6AAB058377C7F6363C241827B5410422D3EF9501952E621F2BB32C2BDF47F44983D5E51277B97EFA1730680BA584B6FCD80FC2EE9B93F2A51F1F1
Malicious:	false
Preview:	2024/09/02-05:15:17.275 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/02-05:15:17.276 23b4 Recovering log #3.2024/09/02-05:15:17.278 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c7d8028-268c-4f73-bb4a-5d93532b16cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b8fff5f-3666-48a4-8093-35124a5b10f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4409f511-0404-42ba-9050-0f8ce57210ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\57b3cab9-9083-4968-8586-534934159aeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\99be717a-b39b-4918-8ac8-1474861523c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF30408.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF39a5d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3f0ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2dd17.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2eb50.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF30408.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\eff32382-0460-48b8-8c75-bf38a4699687.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.300435658365516
Encrypted:	false
SSDEEP:	24:YXsaZVMdBs+YyZFRudFGcsRZFGJ/dbG7n7:YXs+8sOfcdsXgzbg
MD5:	DF8BDC596C8ABB5B46DF611B12368435
SHA1:	04D13C2F1E8DAE1E222523F3724AA9388E007A8A
SHA-256:	0C32BF027E0B44833CE1D80689911D083052DB0657553F0C696BA8C2561BD4F6
SHA-512:	BDEA63E6772074E94B34C770FEEB78B5B5980A243E7C8B237B728355D12C84BC2F10A9C19246AFE8C5848A800E7B0BF9CDC6480CC529321C7E783E9AFBACD2A0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372334118663049","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372334119589526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372334122664770","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2b8b099-f341-4d27-92da-e72b4a09e924.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd6b5dd2-e45e-42bd-ba6e-55b5d2bfb58d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.071757640633986
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjyY5sY5Th6Cp9/x+6M8muecmAeC6e4zvrN2X6gE5Aty:sVnRJkAKxkyY5sYPpj+FVAkNFBf
MD5:	D56F0BAA235555A445DB5544B68FA1F9
SHA1:	1642B2B49421E671AC4C3FFB67ED9967D92A0DD8
SHA-256:	A739B0EA1C3F1376C4431FD50A08459FC75D8121D293E2128E0C98879E33A77A
SHA-512:	B4616F7529B9EF0D87966517D81A835BA1EFFBFB5169161A5233730E37A38F8487AE91A2E6E0CC80CB315FE51AB8CED3862F0ABC031AADCDB1E62AFA92746437
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3738b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.071757640633986
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjyY5sY5Th6Cp9/x+6M8muecmAeC6e4zvrN2X6gE5Aty:sVnRJkAKxkyY5sYPpj+FVAkNFBf
MD5:	D56F0BAA235555A445DB5544B68FA1F9
SHA1:	1642B2B49421E671AC4C3FFB67ED9967D92A0DD8
SHA-256:	A739B0EA1C3F1376C4431FD50A08459FC75D8121D293E2128E0C98879E33A77A
SHA-512:	B4616F7529B9EF0D87966517D81A835BA1EFFBFB5169161A5233730E37A38F8487AE91A2E6E0CC80CB315FE51AB8CED3862F0ABC031AADCDB1E62AFA92746437
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a375.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.071757640633986
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjyY5sY5Th6Cp9/x+6M8muecmAeC6e4zvrN2X6gE5Aty:sVnRJkAKxkyY5sYPpj+FVAkNFBf
MD5:	D56F0BAA235555A445DB5544B68FA1F9
SHA1:	1642B2B49421E671AC4C3FFB67ED9967D92A0DD8
SHA-256:	A739B0EA1C3F1376C4431FD50A08459FC75D8121D293E2128E0C98879E33A77A
SHA-512:	B4616F7529B9EF0D87966517D81A835BA1EFFBFB5169161A5233730E37A38F8487AE91A2E6E0CC80CB315FE51AB8CED3862F0ABC031AADCDB1E62AFA92746437
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e8bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.071757640633986
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjyY5sY5Th6Cp9/x+6M8muecmAeC6e4zvrN2X6gE5Aty:sVnRJkAKxkyY5sYPpj+FVAkNFBf
MD5:	D56F0BAA235555A445DB5544B68FA1F9
SHA1:	1642B2B49421E671AC4C3FFB67ED9967D92A0DD8
SHA-256:	A739B0EA1C3F1376C4431FD50A08459FC75D8121D293E2128E0C98879E33A77A
SHA-512:	B4616F7529B9EF0D87966517D81A835BA1EFFBFB5169161A5233730E37A38F8487AE91A2E6E0CC80CB315FE51AB8CED3862F0ABC031AADCDB1E62AFA92746437
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557647269097734
Encrypted:	false
SSDEEP:	768:DeBYetd7pLGLv7WWPQKfAH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0J4JCrw8DcpUU:DeBYetLcv7WWPQKfAHu1jaBCJnHtL
MD5:	ACB822E02FD18BD947FD9637B1C9FE5A
SHA1:	CDA1C8260A7677D5ADFD901CD3E7BA6379FF6467
SHA-256:	AE7ACDB8D59C68CCE9848A3ABCDE0BA7E7EC9B11903874D4423A32DDDC2981C1
SHA-512:	45B71F033FD2995177907661523A0096E1802A3ECC31F7A314F1B509796DBE70ED3361BC82DF8235576F2D583915391AFC4A8B072F2C0E4C425FFE918BA541F9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742116671982","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742116671982","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33d68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557647269097734
Encrypted:	false
SSDEEP:	768:DeBYetd7pLGLv7WWPQKfAH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0J4JCrw8DcpUU:DeBYetLcv7WWPQKfAHu1jaBCJnHtL
MD5:	ACB822E02FD18BD947FD9637B1C9FE5A
SHA1:	CDA1C8260A7677D5ADFD901CD3E7BA6379FF6467
SHA-256:	AE7ACDB8D59C68CCE9848A3ABCDE0BA7E7EC9B11903874D4423A32DDDC2981C1
SHA-512:	45B71F033FD2995177907661523A0096E1802A3ECC31F7A314F1B509796DBE70ED3361BC82DF8235576F2D583915391AFC4A8B072F2C0E4C425FFE918BA541F9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742116671982","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742116671982","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF39fac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557647269097734
Encrypted:	false
SSDEEP:	768:DeBYetd7pLGLv7WWPQKfAH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0J4JCrw8DcpUU:DeBYetLcv7WWPQKfAHu1jaBCJnHtL
MD5:	ACB822E02FD18BD947FD9637B1C9FE5A
SHA1:	CDA1C8260A7677D5ADFD901CD3E7BA6379FF6467
SHA-256:	AE7ACDB8D59C68CCE9848A3ABCDE0BA7E7EC9B11903874D4423A32DDDC2981C1
SHA-512:	45B71F033FD2995177907661523A0096E1802A3ECC31F7A314F1B509796DBE70ED3361BC82DF8235576F2D583915391AFC4A8B072F2C0E4C425FFE918BA541F9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742116671982","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742116671982","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.124406403974042
Encrypted:	false
SSDEEP:	6:P3N1Fq2Pwkn23oH+TcwtrQMxIFUt823NTZZmw+23NdvkwOwkn23oH+TcwtrQMFLJ:P3N1FvYfYebCFUt823Nt/+23NR5JfYeL
MD5:	84DF2A37E656C1D9AE67B1E000684D29
SHA1:	610F762FD2DD1E8FE327BE9E7E9EC1D195E80A16
SHA-256:	698E1B1C1C68CA72836DED7E91D23DF0BDA6C9A9E7BD0A46B0BF6CCD0A8F2C45
SHA-512:	C04EFE0DBCB7F87A8D88456D0BBAABEF04DB77ED0541EE4903997C8A3E98CBA6CC3C6A31DDB717015A5A4D6B57161865BF5DE9A21827202FF1DB1BEEE1418C37
Malicious:	false
Preview:	2024/09/02-05:15:32.532 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/02-05:15:32.533 23b4 Recovering log #3.2024/09/02-05:15:32.535 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.124406403974042
Encrypted:	false
SSDEEP:	6:P3N1Fq2Pwkn23oH+TcwtrQMxIFUt823NTZZmw+23NdvkwOwkn23oH+TcwtrQMFLJ:P3N1FvYfYebCFUt823Nt/+23NR5JfYeL
MD5:	84DF2A37E656C1D9AE67B1E000684D29
SHA1:	610F762FD2DD1E8FE327BE9E7E9EC1D195E80A16
SHA-256:	698E1B1C1C68CA72836DED7E91D23DF0BDA6C9A9E7BD0A46B0BF6CCD0A8F2C45
SHA-512:	C04EFE0DBCB7F87A8D88456D0BBAABEF04DB77ED0541EE4903997C8A3E98CBA6CC3C6A31DDB717015A5A4D6B57161865BF5DE9A21827202FF1DB1BEEE1418C37
Malicious:	false
Preview:	2024/09/02-05:15:32.532 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/02-05:15:32.533 23b4 Recovering log #3.2024/09/02-05:15:32.535 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.169083796899737
Encrypted:	false
SSDEEP:	6:P3PqL+q2Pwkn23oH+Tcwt7Uh2ghZIFUt823P81Zmw+23P0fOlLVkwOwkn23oH+T8:P3yyvYfYebIhHh2FUt823a/+23XlR5J8
MD5:	C2C71DE87843C46425BECECF56020795
SHA1:	CC01E0971425167EAEE136BD46EE6469DA537B3E
SHA-256:	898F30F4B34ED8EFB475D9718ADA27B10D3D2BB5EB9B62531EC70A1923E78F00
SHA-512:	AB14B5845DA30B10901BABE0A0BBD566CD53604A1EF44CFF61BA3C024BC8A465AD1E755FEA58A3B9D1DF6366B5AB484641F9E3E1EFF29DE27DB6065FA755BF4C
Malicious:	false
Preview:	2024/09/02-05:15:16.660 1c38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/02-05:15:16.660 1c38 Recovering log #3.2024/09/02-05:15:16.661 1c38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.169083796899737
Encrypted:	false
SSDEEP:	6:P3PqL+q2Pwkn23oH+Tcwt7Uh2ghZIFUt823P81Zmw+23P0fOlLVkwOwkn23oH+T8:P3yyvYfYebIhHh2FUt823a/+23XlR5J8
MD5:	C2C71DE87843C46425BECECF56020795
SHA1:	CC01E0971425167EAEE136BD46EE6469DA537B3E
SHA-256:	898F30F4B34ED8EFB475D9718ADA27B10D3D2BB5EB9B62531EC70A1923E78F00
SHA-512:	AB14B5845DA30B10901BABE0A0BBD566CD53604A1EF44CFF61BA3C024BC8A465AD1E755FEA58A3B9D1DF6366B5AB484641F9E3E1EFF29DE27DB6065FA755BF4C
Malicious:	false
Preview:	2024/09/02-05:15:16.660 1c38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/02-05:15:16.660 1c38 Recovering log #3.2024/09/02-05:15:16.661 1c38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulBVPK:Lsy
MD5:	7CBB993EF3702CC81D61FCBE900FE937
SHA1:	BBE837F8CCF97129A512A3046B53C035D1AB71BB
SHA-256:	8A841B7AD41B49A6C9CD328D954197EC4222D5FF0D5DA03B4D88521AB105C064
SHA-512:	397AED5DB9D4EB2ADFBA52CD5C8F89F546DEDC6B604F6209A7331B2342497A722B068B33723E7F2435688853B577278200BE59AE62CAE95DA456D815BB4CB963
Malicious:	false
Preview:	.........................................=../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNli:Ls3
MD5:	7E4E247E07E18F772395BB04F31CA8AB
SHA1:	5B484A89622EED1173703E32C5C4EE5670845487
SHA-256:	10FDAA0E9B8765FA915F7816E95B304CCF1FE9855B05EDF44955D73B910DE7D5
SHA-512:	9BBB3139B9769AA41A3E7D43068511344169D10F958C4C4F97C36F4372A8E9A6F079B0FD97CA758275A7E6477681AA611F4E35620C71C225C7039A1F68053702
Malicious:	false
Preview:	........................................;.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2591307050918505
Encrypted:	false
SSDEEP:	12:P33vYfYebvqBQFUt8233Wd/+23a5JfYebvqBvJ:PfYfYebvZg8W3WREJfYebvk
MD5:	50586BADE3F75F7ACFB4E00936C7DFDF
SHA1:	4AB80475826E1488C1FA509CEFB32C17673C8EBA
SHA-256:	D05AB3562D71FBE06A19E4D00664C3827BE2341312BAC4137218822C691A14E7
SHA-512:	33C013B8269D2358299E61181ED5092C9C5E50E1A63276B920CA67757F0F1A5A7662971F09E4F9274A8BE3421CBE40500DF933C6134268B58D75B3EE9088A480
Malicious:	false
Preview:	2024/09/02-05:15:17.289 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/02-05:15:17.290 23b4 Recovering log #3.2024/09/02-05:15:17.292 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2591307050918505
Encrypted:	false
SSDEEP:	12:P33vYfYebvqBQFUt8233Wd/+23a5JfYebvqBvJ:PfYfYebvZg8W3WREJfYebvk
MD5:	50586BADE3F75F7ACFB4E00936C7DFDF
SHA1:	4AB80475826E1488C1FA509CEFB32C17673C8EBA
SHA-256:	D05AB3562D71FBE06A19E4D00664C3827BE2341312BAC4137218822C691A14E7
SHA-512:	33C013B8269D2358299E61181ED5092C9C5E50E1A63276B920CA67757F0F1A5A7662971F09E4F9274A8BE3421CBE40500DF933C6134268B58D75B3EE9088A480
Malicious:	false
Preview:	2024/09/02-05:15:17.289 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/02-05:15:17.290 23b4 Recovering log #3.2024/09/02-05:15:17.292 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\207657ef-5666-45ad-88cb-f331cd5b3411.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7abecfe8-f36a-44ca-bec6-4ada6f39771c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\98c54a9f-44f6-4b71-996c-32c7f5c50a74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF39a5d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF4024e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2eb50.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b29272af-5bca-460a-baf7-5c5067f43e7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ff88a3db-0bb5-404a-9ce5-5e10b6b5ce72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRKXk1Yn:YH/u2caq3QH7E4TX
MD5:	1192DD11B1F5F8724DA374B0366A428E
SHA1:	CB40812A40613465E160C478DDF991C0AAA00731
SHA-256:	8E9C85442D198CE1085D98E21111320C07C08869CDD11853AF32FDFE8B2FDC58
SHA-512:	B7F100EA4668A801CA3BE81F38615E66EC871A8E093742D9B9673A278094508EA7099B6799EEF5D9C8FC5BB9CF72E52AC638EF93BBE14CB860E008BDBCA6FA32
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.267456403766367
Encrypted:	false
SSDEEP:	12:P3NTFvYfYebvqBZFUt823Nr/+23NZF5JfYebvqBaJ:PLYfYebvyg8WZLXJfYebvL
MD5:	CCD698F3DA2DE6AA742A703D7620B60E
SHA1:	DA32BCE6AD36F39E75284848EC7EB3CD8333B265
SHA-256:	B86EB28FBBDA250AAFC02BAB1E862E0FA320EE3869F1E1251F52EAC4EADC1B87
SHA-512:	A40EC4BAA027CB5DF66AF6D5D0699AD80E0C0AAA34299BD5D747DD01AAA4EBCC902542C896DDAFC0F6DB33365389CAF2BB460EB97A5C47DEC9BF877E8C437CB5
Malicious:	false
Preview:	2024/09/02-05:15:32.776 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/02-05:15:32.777 23b4 Recovering log #3.2024/09/02-05:15:32.779 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.267456403766367
Encrypted:	false
SSDEEP:	12:P3NTFvYfYebvqBZFUt823Nr/+23NZF5JfYebvqBaJ:PLYfYebvyg8WZLXJfYebvL
MD5:	CCD698F3DA2DE6AA742A703D7620B60E
SHA1:	DA32BCE6AD36F39E75284848EC7EB3CD8333B265
SHA-256:	B86EB28FBBDA250AAFC02BAB1E862E0FA320EE3869F1E1251F52EAC4EADC1B87
SHA-512:	A40EC4BAA027CB5DF66AF6D5D0699AD80E0C0AAA34299BD5D747DD01AAA4EBCC902542C896DDAFC0F6DB33365389CAF2BB460EB97A5C47DEC9BF877E8C437CB5
Malicious:	false
Preview:	2024/09/02-05:15:32.776 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/02-05:15:32.777 23b4 Recovering log #3.2024/09/02-05:15:32.779 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.234956443372522
Encrypted:	false
SSDEEP:	6:P3P/L+q2Pwkn23oH+TcwtpIFUt823P/wz1Zmw+23PPFLVkwOwkn23oH+Tcwta/Wd:P3HyvYfYebmFUt823nwZ/+233FR5JfYM
MD5:	C32C3F7BC1E3A51FEFB645B77ABC4969
SHA1:	BDF5A198F58B3D932395E3D3FE5DC60797794529
SHA-256:	280F7DF449F50AF1683FC87DE1590E5975610CB0F2AA3FA4FC1BDD58E81CD519
SHA-512:	C355942BFA2E8D3053B862CD25A3FB5271CB395EAF5BFFEDF49804CB29935F1D97C66FABBF8E2A2DB639C6B4A7310B70084E581D84F7300D554B836E47DB7A1E
Malicious:	false
Preview:	2024/09/02-05:15:16.630 1c38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/02-05:15:16.631 1c38 Recovering log #3.2024/09/02-05:15:16.632 1c38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.234956443372522
Encrypted:	false
SSDEEP:	6:P3P/L+q2Pwkn23oH+TcwtpIFUt823P/wz1Zmw+23PPFLVkwOwkn23oH+Tcwta/Wd:P3HyvYfYebmFUt823nwZ/+233FR5JfYM
MD5:	C32C3F7BC1E3A51FEFB645B77ABC4969
SHA1:	BDF5A198F58B3D932395E3D3FE5DC60797794529
SHA-256:	280F7DF449F50AF1683FC87DE1590E5975610CB0F2AA3FA4FC1BDD58E81CD519
SHA-512:	C355942BFA2E8D3053B862CD25A3FB5271CB395EAF5BFFEDF49804CB29935F1D97C66FABBF8E2A2DB639C6B4A7310B70084E581D84F7300D554B836E47DB7A1E
Malicious:	false
Preview:	2024/09/02-05:15:16.630 1c38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/02-05:15:16.631 1c38 Recovering log #3.2024/09/02-05:15:16.632 1c38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:F//Kl1lhtlD/n:F//K3T/n
MD5:	B141E1688E4C3DB34A4219811E791B63
SHA1:	BBE81BEA03DAF6486F98B36325F5ED3951A05B5F
SHA-256:	795219F5B9B41D554B47463F56505A3BAD76B41C1AAA4B382F800CEC8667E0A1
SHA-512:	D88110CC773E87B1E4836103E3C7F4A0F64E3421C34A670F09EC67B8040B90D05C49A4212DD3C27E5A37ABEAC191416307D95C56EFA1382D0ABDEA620CAFB70B
Malicious:	false
Preview:	............-I.....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a6ca4de4-df41-4042-b2b6-fbc0b1153bb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.071757640633986
Encrypted:	false
SSDEEP:	96:sVIaqlY3J1Kb95lSVKxXyjyY5sY5Th6Cp9/x+6M8muecmAeC6e4zvrN2X6gE5Aty:sVnRJkAKxkyY5sYPpj+FVAkNFBf
MD5:	D56F0BAA235555A445DB5544B68FA1F9
SHA1:	1642B2B49421E671AC4C3FFB67ED9967D92A0DD8
SHA-256:	A739B0EA1C3F1376C4431FD50A08459FC75D8121D293E2128E0C98879E33A77A
SHA-512:	B4616F7529B9EF0D87966517D81A835BA1EFFBFB5169161A5233730E37A38F8487AE91A2E6E0CC80CB315FE51AB8CED3862F0ABC031AADCDB1E62AFA92746437
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369742116868880","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aa700709-6cbb-4e07-a952-856ec28c7bd4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565682986272638
Encrypted:	false
SSDEEP:	768:DeBYetd7pLGLv7WWPQKfnH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVylHJ4JCrwtevl:DeBYetLcv7WWPQKfnHu1jablHCJnlt2
MD5:	3C55C049C2673447064F83B58E5D4734
SHA1:	5E2261D0FE7569468D4C5DD93E41CEC88640ED86
SHA-256:	6E0BDB077B6404D20C85BAB2CA135EE0B31E1430EAC2875348BA245DF8B6CF91
SHA-512:	AF447B51310BD58ACB9B407F674E070C067DDAE10480DE65EEA22CDBDAF6DD62AECA4BE3C442B0A4EF7F918538FE218516CA2D8A4ABD2F2EB2F3C0F04D112CF3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369742116671982","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369742116671982","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.225716262333249
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxljlHFl3seGKT9rcQ6xfRn:/XntM+4ljlll3sedhOJ
MD5:	D88DF582FE52D7FBB6A3B2BAF7B5E529
SHA1:	4586ADD5BF1D0105BF0239CD2F81BF1BEF1A13F6
SHA-256:	D4F1E9F135092D91780DB5F5C5E30574FF9D2665A2C88ECE959CB6CBFD1D2BDD
SHA-512:	250F11269C44F1AF2941CE06F0DD81334E5F844713CF6626A33C7D9904E94C577EFCD69AB8274947BB588D2C7E8AE7D861382C098131D5B66E7FC5C4726629FF
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f...................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.187225364954371
Encrypted:	false
SSDEEP:	6:P3PE81wkn23oH+Tcwtfrl2KLll3PNAFIq2Pwkn23oH+TcwtfrK+IFUv:P3MbfYeb1Ln3bvYfYeb23FUv
MD5:	01A60DD985A5BB04295598F2F76B42B6
SHA1:	A5535DF4D9B408D95FD5B3DC1654D79A5C4D7715
SHA-256:	56F5FB3A24FFCACB43A14D3F75EBC761B8A78CC0F4C4DDFE5DA5B910DB1641B5
SHA-512:	CCE05D745A85D886C25FB5FB8843F3C6A00F80C33C1581CF5CB4A8454DB9067B748AFD21444E047AE7324E6CB85DFBFDFE0976BDC27A2F4DE66FF800CA103C81
Malicious:	false
Preview:	2024/09/02-05:15:17.028 1e50 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/02-05:15:17.045 1e50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9186711125784504
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/h43oqXVf9aebtDvRtin01zv0:G0nYUtPrPJ6+3oqXuebtbL0
MD5:	F40060A2AF9450BE122761C28F055691
SHA1:	6B82BA029202A30F4B60C4A418B93BB375DA3E26
SHA-256:	43075FF9CA0D0728D7231FA2A3F3E03DA5A7FB5FF4F9BE87E285E194B78A6AD4
SHA-512:	89C5A65EF24FB6AB827F53E45FFCD176B809A2860D1D0CD10498D0779F27D2DD0DFEB0FB8B904C48DE2439A7B3E822FDC58A0310B4D6519F94D2F832C62CB2CF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_.........................20_...../...................20_......@C1.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....~..%.................21_.....2...................21_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.167747056641825
Encrypted:	false
SSDEEP:	6:P3Pr81wkn23oH+Tcwtfrzs52KLll3PIq2Pwkn23oH+TcwtfrzAdIFUv:P3DbfYebs9Ln3gvYfYeb9FUv
MD5:	42D70034EF5A7FFCEF8EEF8B45533E07
SHA1:	5F01B320F3AB669A79A2814667CB8FAE05E4C2BE
SHA-256:	FD0CD4142955373AB2C3D02E6F91631AF2B8C381F6C1DED51BBCF02F13F56106
SHA-512:	2490CCE6E53E3E5A15DFED75ECE628E08E26398DAC44B5D91B58B720D89DFFCAAD45D49AD2EC680A16172717F37C460F435725C05A16D47821EC0B15448720BE
Malicious:	false
Preview:	2024/09/02-05:15:16.918 1e50 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/02-05:15:17.026 1e50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNloNQB:Ls3oC
MD5:	5F3039FAF5B7E94954C20AA2456157CB
SHA1:	E8B29C81C33D5D3967A024A89469C0B1E3C95C85
SHA-256:	D5EB2CEFF3DA13DA462553531A9B3A3B04F13122A2DAB9F7BCA5960B160F6262
SHA-512:	AEF7A92E47BAE5F51ED043634E5C44F66780DD49FA9B148CA8CBBED84BFD8BCCDB68A9D30689E2C5F9AC0DDEE11501E8092F53F71366251027B4770223535007
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlnsT:Ls3sT
MD5:	69570B0887A20F34FD4539927A18B121
SHA1:	C607651A870FD60EDBC14D2E38E653919F399AE0
SHA-256:	B32060A3060DA5B76B613B5633A262BB1870BA852DC9177F4AC423FF78551444
SHA-512:	622E5B4437938AD7CAEDF1257CDF8CAA7BC72EB6FA02D990EB7AE38000401D7521D70510F2EC7A403E6D18AA8B0A33FF3FE39356CE48C6D738D72D5A0DBC9FF2
Malicious:	false
Preview:	.........................................!..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d7c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d855.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f860.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f8ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f8be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF316d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF316e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34b52.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34b62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c17c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e89c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43842.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.795280775088648
Encrypted:	false
SSDEEP:	96:iaqkHfgBUA5ih/cI9URLl8Roto6MFVvlwhhe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:ak4OeiRUFhj6qRAq1k8SPxVLZ7VTiq
MD5:	A065A69F51ABDE17A307FDFB4F803197
SHA1:	FF6ACAF4D0A3681F8ED264B5C7F9FAD98FE2B529
SHA-256:	8D4179243D05012C5EDBE8AEA556B8E4475725A29C0269FE1F556D3B6166B171
SHA-512:	D506A1447A9FCBF4C5376432E56191BF2C0A888642723D7DDA4FD34CB5EC3FF37BDBD038E667A69BB45221325B92D8319C36FC1916BD0AC1D548CECFFBF0E0A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABfKiRzkZG0SLFgHWtfHkJVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADqdxmK+3AtNM1hcIJQXkyTDgZsf5UDB8UBLrGo+xVB7AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlEST:Ls3EST
MD5:	1D41A0F1FCB74CE17D6080D4EB3FF816
SHA1:	2577C4547CD071634A3051EFBF8E4DA74764B0B1
SHA-256:	9302A033E4499A9349AB422866D44C207D19FE69DFEB973B6A231B6C080F1430
SHA-512:	272CBC3B8554BCAC9BD459A55872D58F95CF5DFD02ED7645A1E9CDB8DC45AF008AF08E1C7B529E74B53E350AEB97A82F917CDDC47CED2859EB04AF372B26692D
Malicious:	false
Preview:	........................................f...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc34f914-ab67-4a59-977f-5f965aa6408e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.8334960546139865
Encrypted:	false
SSDEEP:	192:fsNw4aeiRU2c1nQ5OySkC+96qRAq1k8SPxVLZ7VTiB:fsNwVPcQ51RC+96q3QxVNZTiB
MD5:	2D8902F459BD35EDAD9E085A4D22AE49
SHA1:	842B72D58DDCCB3864237627ED072B86B439195F
SHA-256:	9F91C951AB7ED10CA8CAFF0B7BED21F1AABD688732886B04093FF4C33FC43177
SHA-512:	7AC3742B9BB7C404BB2AEAE3BAB237A8EE0CF6CA3773764416E4C29495691BBE48555CA4CB143682189A6FCFA1618EEDE22C3ECB9E12A155E27F20E8C4FF86FA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e71629d1-e5b1-4a28-9de7-99b3895ca6a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	60170
Entropy (8bit):	6.081596731024775
Encrypted:	false
SSDEEP:	1536:AMGQ5XMBGIaf8dP0Sf3H5WFDnOaZA4j0b+CYz1X:AMrJM8pkdP0Sf394QRYz1X
MD5:	E5946B6A874B6B7140BB919AC4EC6173
SHA1:	29ADFDF0CBBC46FFE2A8FAE1674492EC449EE479
SHA-256:	DC279203EC9145E63AE9424E20532085A072540DF3C39F279CE0F788EE42F398
SHA-512:	68D9E9909F8C78B8B352F63EDFB0A747FCD7FC98491FF322B1F8233FAD1B71BD0C19EE91AD59BEECA2184833BC9BDED626C0A23CDA86289DADF2EA86E035C13F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369742116893072","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8461163031831607
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxRxl9Il8utWli44yBZd4EKLyeaFQnd1rc:mkY7Wlr4yBZd4fLFu
MD5:	AC8812F6279B826F2FCBC8FD6D9207B6
SHA1:	C93D96FD6B098ECD4CF72CC7D1F490DE3885FA0C
SHA-256:	4DA6D49B3790E406D1A5AA5D4415B65960491011886A0AA3BD77B5404A9B3475
SHA-512:	36AFAC8DCD26FDC21AB6A0C891D5114310C113C54553D2E2D7F1F6D99EFE698678025E720F1B1A503EC6A2D03AC3ED4D50B3097ADECBB49F13E12353F9F6261D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.Q.+.+.i.D.9.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.X.y.o.k.c.5.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9928724122338175
Encrypted:	false
SSDEEP:	96:2Y7WlUHGhu1+DjkJeFgl5GRDWhu7SJngkx0uNU:2feHG0LJ/7G1h7MrVNU
MD5:	0A04F03B996F426C94C40F4746F03070
SHA1:	3CE2834B7553BABE1EE3B3505F419480DFC29138
SHA-256:	75BD47C24C691745A53B4590BFA2A2E0063A1B781B6D4B69F1C5811F0570E128
SHA-512:	3240D0E2C9E0DF4D5FBA731F3747A06177BCFDEE4C5C1440EAF398EEEAA9DDBF97A41AEE3BEBC8BB9CEA9943A2AA645AD9950040C980E466FD067C9325C39F2F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".l.q.t.N.4.B.j.9.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.X.y.o.k.c.5.

C:\Users\user\AppData\Local\Temp\1463f63c-d2c7-4e0d-8302-ac4d71835263.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\83451388-1943-42ee-876e-30f1ce6ea241.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.358391873787501
Encrypted:	false
SSDEEP:	12:Y7F1PY9x0Dkv/Sr5x56s/SJU3fdfp0Dkv/SCR05O56s/C:Y7F1PYP0/lx5Iq3fxp0/C25O5M
MD5:	8153EC203C1E937591B52F9559198CC5
SHA1:	FA4B98CB13576C67FD25432AD862EB8A1229092A
SHA-256:	8F3FAAAB474C5D786C80E163A9DA2F1A1394EBE7D4C0FFC6CEB596824596DBAF
SHA-512:	E05BC05C433880DAF348273728E3E45E48E94AC45692C5D50749F33AC515C3709E575B6BA8E98EA532B2D2A03632E00F6B143CFC9844193AD470072EB4CD40E4
Malicious:	false
Preview:	{"logTime": "0902/091506", "correlationVector":"032EB606343F4333A325C738CF53EAE5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0902/091518", "correlationVector":"ZLbfxleY8QZOUX0G/RnTU1","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0902/091518", "correlationVector":"CE49F62CB17540C3B160C269DB4D28A3","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0902/091518", "correlationVector":"bt3yxtfbhMFk3omQJr4mrE","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\de4f95cd-c2a9-44cb-8e2b-5e8870fb2326.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\e66aec0e-8dfb-4d06-81d0-5d41ac1261d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\83451388-1943-42ee-876e-30f1ce6ea241.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8224_1034613806\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir8224_55750875\1463f63c-d2c7-4e0d-8302-ac4d71835263.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8224_55750875\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8224_55750875\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8224_55750875\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8224_55750875\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\121VFQQ3TVS5SGP4FWX6.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5175501692107867
Encrypted:	false
SSDEEP:	48:gEtv3dOor+YsJVrWzBdLXuHUkDpu2Atv3dOor+YsJVrWzngdLXuHUk+21:j3u0kDJKnIu0kz
MD5:	8BEBFC265E40FA66419E6A58B1282A91
SHA1:	7544D3E1D5FFC905CCE58CA0DB2B4F744D68E3E1
SHA-256:	F7812F6DA2CE7D51FAD99980F9EF12F33C8E2B7E2558AB10D150B08392A2EFBD
SHA-512:	14C338BEE7D2F675F0ED6BEE164ADB76D4EB0E7D1B8D09EB77D8B81CD7B890F7C5127C1DAD1D69A3B1F0720FCD73F41A707748586E84449A565578FB0911B9DC
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....w.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1....."Y.I..PROGRA~2.........O.I"Y.I....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux."Y.I..........................}...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8."Y.I...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.I..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.I....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........>xU......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.518450220883049
Encrypted:	false
SSDEEP:	48:gEh3dOoSYsJVrWzBdLXuHUkDpu2Atv3dOor+YsJVrWzngdLXuHUk+21:f3u0kDJKnIu0kz
MD5:	8AE6FCD5DF35393786A4F6F404DAACFE
SHA1:	11EF1F51431F1B171DD2EAE1E314F9CBF9878C8A
SHA-256:	9D90BA9C250A1565FA921DEA83A988DE75D489B3D5530F3608E017439AEB5F39
SHA-512:	FD34908CB20190C24CAE0551882EE1F9D63E127988328C10E7238116EF31ED625ED598011E2C8638C0AC900489E32FF74FDD4E1D89F93829510FB3A8716357E6
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....w.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWT`..PROGRA~2.........O.IDWT`....................V......C<.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux."Y.I..........................}...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.I..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.I....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........>xU......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P81AA86UFTU07TDCN5JJ.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.518450220883049
Encrypted:	false
SSDEEP:	48:gEh3dOoSYsJVrWzBdLXuHUkDpu2Atv3dOor+YsJVrWzngdLXuHUk+21:f3u0kDJKnIu0kz
MD5:	8AE6FCD5DF35393786A4F6F404DAACFE
SHA1:	11EF1F51431F1B171DD2EAE1E314F9CBF9878C8A
SHA-256:	9D90BA9C250A1565FA921DEA83A988DE75D489B3D5530F3608E017439AEB5F39
SHA-512:	FD34908CB20190C24CAE0551882EE1F9D63E127988328C10E7238116EF31ED625ED598011E2C8638C0AC900489E32FF74FDD4E1D89F93829510FB3A8716357E6
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....w.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWT`..PROGRA~2.........O.IDWT`....................V......C<.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux."Y.I..........................}...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.I..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.I....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........>xU......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5175501692107867
Encrypted:	false
SSDEEP:	48:gEtv3dOor+YsJVrWzBdLXuHUkDpu2Atv3dOor+YsJVrWzngdLXuHUk+21:j3u0kDJKnIu0kz
MD5:	8BEBFC265E40FA66419E6A58B1282A91
SHA1:	7544D3E1D5FFC905CCE58CA0DB2B4F744D68E3E1
SHA-256:	F7812F6DA2CE7D51FAD99980F9EF12F33C8E2B7E2558AB10D150B08392A2EFBD
SHA-512:	14C338BEE7D2F675F0ED6BEE164ADB76D4EB0E7D1B8D09EB77D8B81CD7B890F7C5127C1DAD1D69A3B1F0720FCD73F41A707748586E84449A565578FB0911B9DC
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....w.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1....."Y.I..PROGRA~2.........O.I"Y.I....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux."Y.I..........................}...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8."Y.I...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.I..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.I....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........>xU......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579750714632455
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	02f05a4f911bd2da08549f1eec6ea277
SHA1:	d58d5d2125e732cee302ec8bc264cbee7ac60d43
SHA256:	0f3b6be147d1935f932ea4c2ae02d3b6dd730be852a6314c9d5e4036d1b126a1
SHA512:	94cf19fb2899eb677e37a51574560aae4ab8e0e64be7b9986e658da8a9a9d11e832f54bee2de5301068afa022d21738132a9feaeca3a734723b4113e525d2eba
SSDEEP:	12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTm:qqDEvCTbMWu7rQYlBQcBiT6rprG8asm
TLSH:	2E159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D576E5 [Mon Sep 2 08:27:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FA81D2745E3h
jmp 00007FA81D273EEFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FA81D2740CDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FA81D27409Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FA81D276C8Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FA81D276CD8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FA81D276CC1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	413f6330167e4e1aca54e615fd24972a	False	0.28692708333333333	data	5.165540850453989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 11:15:05.250339031 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 2, 2024 11:15:08.013639927 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.013665915 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.013766050 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.013793945 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.013818979 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.013832092 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.014039993 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.014053106 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.014168024 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.014178038 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.104074955 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.104098082 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.104217052 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.104948044 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.104962111 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.105011940 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.105158091 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.105164051 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.105257034 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.105402946 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.105418921 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.105719090 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.105731010 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.106129885 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.106136084 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.106195927 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.106409073 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.106417894 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.106636047 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.106647015 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.150738001 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.150747061 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.150805950 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.151596069 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.151607037 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.541929007 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.542108059 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.542141914 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.542157888 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.542265892 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.542272091 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.543016911 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.543070078 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.543150902 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.543209076 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.543956995 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.544015884 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.544204950 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.544258118 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.544317007 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.544318914 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.544322968 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.544579029 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.544589996 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.544636011 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.544641018 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.545454025 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.545501947 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.546303988 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.546360970 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.546389103 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.559170008 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.559376955 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.559385061 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.560230970 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.560281038 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.561125994 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.561178923 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.561271906 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.592503071 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.604504108 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.611301899 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.612895012 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.612903118 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.613770008 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.613838911 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.614682913 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.614733934 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.614964962 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.614969015 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.623121023 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.623339891 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.623347044 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.623605013 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.624154091 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.624164104 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.624217987 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.624269009 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.625051975 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.625108957 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.625147104 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.625169992 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.625710011 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.625768900 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.625977039 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.625983000 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.626070976 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.626082897 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.656585932 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.656596899 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.656603098 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.656610012 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.656620979 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.657432079 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.657494068 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.657824039 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.657839060 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.658960104 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.659060001 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.659168959 CEST	49749	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.659184933 CEST	443	49749	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.671319008 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.671382904 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.671544075 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.671839952 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.671844959 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.697563887 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.697637081 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.724003077 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.724045038 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.724061966 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.724076033 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.724119902 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.726016045 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.726032019 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.726104021 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.726126909 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.726136923 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.726140022 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.726208925 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.740696907 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.742548943 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.787061930 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:08.787075996 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:08.790302992 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:08.790308952 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:08.807854891 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.807863951 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.807885885 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.807909966 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.807924032 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.807936907 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.807952881 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.808015108 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.810148001 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.810168982 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.810239077 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.810250044 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.810264111 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.810297966 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.892539978 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.892558098 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.892585993 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.892649889 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.892663002 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.892674923 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:08.892699957 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:08.892714977 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:09.174257040 CEST	49747	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:09.174271107 CEST	443	49747	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:09.190831900 CEST	49746	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:09.190848112 CEST	443	49746	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:09.362121105 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.362143993 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.362310886 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.362329960 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.362343073 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.362370014 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.362947941 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.362962008 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.363078117 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.363094091 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.641875982 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.641907930 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.641956091 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.642419100 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.642445087 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.642519951 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.642568111 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.642580032 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.642724991 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.642739058 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.657243013 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.657260895 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.657427073 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.657433987 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.657461882 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.657485008 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.657661915 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.657675028 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.657742023 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.657753944 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.819502115 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.819787025 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.819796085 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.820077896 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.820617914 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.820679903 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.821469069 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.821780920 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.821791887 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.822103977 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.822362900 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.822419882 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.860100985 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:09.860131025 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:09.860255003 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:09.862027884 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:09.862040997 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:09.875533104 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.883546114 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:09.883565903 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:09.883637905 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:09.883760929 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:09.883771896 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:09.983206987 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:10.079062939 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.079405069 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.079417944 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.079694033 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.080229998 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.080281019 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.091283083 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.091711998 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.091720104 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.092637062 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.092693090 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.098428965 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.098495960 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.104139090 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.104374886 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.104383945 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.104660988 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.104938984 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.104996920 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.117203951 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.117397070 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.117407084 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.118256092 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.118308067 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.118748903 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.118803024 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.125361919 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.156613111 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.156613111 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.156624079 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.172238111 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.172247887 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:10.219110966 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.254729986 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.452176094 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.452367067 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.452378988 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.453247070 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.453489065 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.454312086 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.454365969 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.454473019 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.454479933 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.461823940 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.461970091 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.464965105 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.464972973 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.465195894 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.500945091 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.508788109 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.556503057 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.567162991 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.567183018 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.567267895 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.567277908 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.567440987 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.567572117 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.568157911 CEST	49762	443	192.168.2.4	20.96.153.111
Sep 2, 2024 11:15:10.568180084 CEST	443	49762	20.96.153.111	192.168.2.4
Sep 2, 2024 11:15:10.712644100 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.712690115 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.712946892 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.712973118 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.712984085 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.712984085 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.712990999 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.712997913 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.753886938 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.753912926 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:10.754851103 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.755983114 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:10.755997896 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.361287117 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.361356020 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:11.659352064 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:11.659385920 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:11.659440994 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:11.659471035 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:11.659477949 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:11.659521103 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:11.659662962 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:11.659677029 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:11.659744978 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:11.659754992 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:11.663518906 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:11.663538933 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.663827896 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.665260077 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:11.708504915 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.839425087 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.839497089 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.839541912 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:11.855437994 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:11.855456114 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:11.855464935 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 11:15:11.855473042 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 11:15:12.056113958 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.056143999 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.056197882 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.056545019 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.056559086 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.106672049 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.106899023 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.106923103 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.107239962 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.107302904 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.107829094 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.107877970 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.113883018 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.113939047 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.114209890 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.114217997 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.116425037 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.116595984 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.116601944 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.116957903 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.117017031 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.117649078 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.117702007 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.118119955 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.118172884 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.118479967 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.118484020 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.157681942 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.172669888 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.232161045 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.232758999 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.232803106 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.232829094 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.232829094 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.232846022 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.232883930 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.243997097 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.244273901 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.244362116 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.244539976 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.244544983 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.244551897 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.244584084 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.510899067 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.511154890 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.511174917 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.512193918 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.512316942 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.513459921 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.513518095 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.514527082 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.514533997 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.536196947 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.536228895 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.536284924 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.536478043 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.536494017 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.554521084 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.554544926 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.554615021 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.554830074 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.554843903 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.564297915 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.608089924 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.608151913 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.608185053 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.608227015 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.608259916 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.608270884 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.608350039 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.608380079 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.610521078 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.610691071 CEST	49769	443	192.168.2.4	142.250.65.228
Sep 2, 2024 11:15:12.610711098 CEST	443	49769	142.250.65.228	192.168.2.4
Sep 2, 2024 11:15:12.983947039 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.984850883 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.984869003 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.985179901 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.985265970 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.985773087 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.985881090 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.986061096 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.986116886 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.001394987 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.001595020 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.001610994 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.001924038 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.002039909 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.002523899 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.002619028 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.002753973 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.002804041 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.032567024 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.032577991 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.047389984 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.047405958 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:13.078253031 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:13.094614983 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:18.643635988 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:18.643673897 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:18.643724918 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:18.644457102 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:18.644469976 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.370946884 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:19.370978117 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:19.371164083 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:19.372435093 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:19.372452974 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:19.439960957 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.445039034 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.445055008 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.446069956 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.446158886 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.447365046 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.447434902 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.448010921 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.448019028 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.495027065 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.622040033 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:19.622049093 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:19.622150898 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:19.622498035 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:19.622507095 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:19.628685951 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:19.628721952 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:19.628890038 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:19.629050016 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:19.629064083 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:19.855068922 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.855518103 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:19.855618954 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.860666990 CEST	49772	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:19.860677004 CEST	443	49772	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:20.045032024 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:20.045185089 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:20.049555063 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:20.049563885 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:20.049833059 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:20.096712112 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:20.236452103 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.237088919 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.237112045 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.237428904 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.237442017 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.237605095 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.237615108 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.237658978 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.238033056 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.239675045 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.239734888 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.239968061 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.260761023 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.261236906 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.261250973 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.262104034 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.262207031 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.263355970 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.263410091 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.263567924 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.263573885 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.282496929 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.282507896 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.313754082 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.329356909 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.362747908 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.362771034 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.362777948 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.362812996 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.362837076 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.362847090 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.362871885 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.362886906 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.363140106 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.363179922 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.363224030 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.364039898 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.364048958 CEST	443	49779	13.107.246.73	192.168.2.4
Sep 2, 2024 11:15:20.364103079 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.364141941 CEST	49779	443	192.168.2.4	13.107.246.73
Sep 2, 2024 11:15:20.491437912 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.491475105 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.491514921 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.491529942 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.495168924 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.495219946 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.495229959 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.501332998 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.501375914 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.501385927 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.507211924 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.507266045 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.507276058 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.513082027 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.513118982 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.513128042 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.519020081 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.519061089 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.519068956 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.525219917 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.525273085 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.525280952 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.531164885 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.531208992 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.531215906 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.573859930 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.573906898 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.573916912 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.575189114 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.575227022 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.575233936 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.581140041 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.581181049 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.581188917 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.587212086 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.587250948 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.587258101 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.593291044 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.593336105 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.593344927 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.599180937 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.599220991 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.599229097 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.608805895 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.608848095 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.608855963 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.613682985 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.613724947 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.613733053 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.619616032 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.619658947 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.619668007 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.623158932 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.623202085 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.623209953 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.628022909 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.628173113 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.628185987 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.638209105 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.638245106 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.638252020 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.638314962 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.638353109 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.638360023 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.643534899 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.643575907 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.643583059 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.648569107 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.648610115 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.648617029 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.653871059 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.653908968 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.653919935 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.659154892 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.659193039 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.659198999 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.662697077 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.662731886 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.662738085 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.666749001 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.666794062 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.666800976 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.670101881 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.670139074 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.670145988 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.673562050 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.673607111 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.673614025 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.676768064 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.676809072 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.676815987 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.680129051 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.680180073 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.680186987 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.683612108 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.683651924 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.683656931 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.686670065 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.686709881 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.686717033 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.690023899 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.690073967 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.690080881 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.693377972 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.693420887 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.693428993 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.696654081 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.696692944 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.696702003 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.700084925 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.700126886 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.700134993 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.703489065 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.703533888 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.703541994 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.706743956 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.706788063 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.706795931 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.710040092 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.710089922 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.710098028 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.713440895 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.713485956 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.713493109 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.716685057 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.716728926 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.716737032 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.720763922 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.720812082 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.720820904 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.723431110 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.723476887 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.723484039 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.726363897 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.726485014 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.726491928 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.729702950 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.729758978 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.729767084 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.732553959 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.733187914 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.733196020 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.735682011 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.735707998 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.735738993 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.735749960 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.735789061 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.738765001 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.741542101 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.741595030 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.741602898 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.742434978 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.742487907 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.749943018 CEST	49780	443	192.168.2.4	142.250.186.65
Sep 2, 2024 11:15:20.749960899 CEST	443	49780	142.250.186.65	192.168.2.4
Sep 2, 2024 11:15:20.896229982 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:20.896253109 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:20.896332026 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:20.902544975 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:20.902558088 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.018352032 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.060508966 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239789009 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239805937 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239813089 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239820957 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239846945 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239864111 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.239881039 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.239892960 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.239892960 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.239928961 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.240730047 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.240787983 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.240799904 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.240897894 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.240950108 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.683063030 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.683501005 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.683517933 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.683917999 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.685084105 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.685167074 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.736048937 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.927669048 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.927669048 CEST	49777	443	192.168.2.4	13.85.23.86
Sep 2, 2024 11:15:21.927696943 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:21.927707911 CEST	443	49777	13.85.23.86	192.168.2.4
Sep 2, 2024 11:15:22.027192116 CEST	49723	80	192.168.2.4	199.232.214.172
Sep 2, 2024 11:15:22.033060074 CEST	80	49723	199.232.214.172	192.168.2.4
Sep 2, 2024 11:15:22.033175945 CEST	49723	80	192.168.2.4	199.232.214.172
Sep 2, 2024 11:15:23.318466902 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.318495989 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.318734884 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.319830894 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.319852114 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.319909096 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.351286888 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.351300001 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.360003948 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.360018015 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.486963034 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.486975908 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:23.487199068 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.487876892 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.487885952 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:23.788316011 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.788896084 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.788908005 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.789757967 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.789817095 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.790880919 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.790937901 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.791065931 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.803728104 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.803922892 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.803934097 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.804800987 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.804861069 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.805702925 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.805759907 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.806018114 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.806025028 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.832508087 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.844835043 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.844842911 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.860855103 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.891423941 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.907836914 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.907877922 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.908052921 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.908962011 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.908970118 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.922422886 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:23.922893047 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.922900915 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:23.923304081 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.923355103 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.923446894 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.923583031 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:23.923590899 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:23.923779011 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:23.923845053 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.925580025 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.925631046 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:23.925728083 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.970136881 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:23.970149040 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:24.016597033 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:24.047611952 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:24.047658920 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:24.047811985 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:24.047977924 CEST	49790	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:24.047982931 CEST	443	49790	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:24.733634949 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:24.733664036 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:24.733716011 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:24.733727932 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:24.733752012 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:24.733786106 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:24.992844105 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:24.992908955 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:24.993047953 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:25.005822897 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:25.005884886 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:25.005928040 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:25.015373945 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:25.015422106 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:25.015543938 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:25.026634932 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:25.026684046 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:25.026757002 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:37.741461992 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:37.741492987 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:37.741554976 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:37.741713047 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:37.741745949 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:37.741786003 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:37.741935015 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:37.741946936 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:37.742098093 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:37.742113113 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.355643034 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.355674982 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.355863094 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.355880022 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.355981112 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.356002092 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.356161118 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.356281042 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.356554985 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.356610060 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.356945992 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.357007980 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.406857967 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.406933069 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:53.265722036 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:53.265789986 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:53.265844107 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:53.267158031 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:53.267214060 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:53.267258883 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.325938940 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.325962067 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.325982094 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.326016903 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.019901991 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.019932032 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.019996881 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.022850037 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.022865057 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.455609083 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:57.455626965 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.455656052 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:57.455686092 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.472821951 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.473110914 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.473123074 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.473396063 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.473660946 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.473721981 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.473778963 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.516495943 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.743053913 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.743099928 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.743100882 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:57.743124008 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:57.743144035 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.743176937 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:57.743343115 CEST	49793	443	192.168.2.4	23.200.0.42
Sep 2, 2024 11:15:57.743357897 CEST	443	49793	23.200.0.42	192.168.2.4
Sep 2, 2024 11:15:57.743366003 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:57.743379116 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.033036947 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:58.033051014 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:58.048671007 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:58.048686981 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:58.297358036 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.297643900 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.297661066 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.298510075 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.298583984 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.300123930 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.300180912 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.300353050 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.300359964 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.345470905 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.423223972 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:58.423258066 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:58.423335075 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:58.423785925 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:58.423796892 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:58.458523035 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.459609032 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.459616899 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.459657907 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:58.459685087 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.459731102 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.460033894 CEST	49794	443	192.168.2.4	152.195.19.97
Sep 2, 2024 11:15:58.460047960 CEST	443	49794	152.195.19.97	192.168.2.4
Sep 2, 2024 11:15:59.034483910 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034507036 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.034568071 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034673929 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034679890 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.034723043 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034805059 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034816980 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.034892082 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034900904 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.194511890 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.194616079 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.197921991 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.197928905 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.198144913 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.239336014 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.284498930 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.478601933 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.478858948 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.478878021 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.479186058 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.479643106 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.479736090 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.480098963 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.480249882 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.480257988 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.480601072 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.480837107 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.480896950 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.519864082 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.519882917 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.519890070 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.519901991 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.519932032 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.519958019 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.519969940 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.519999981 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.520019054 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.520860910 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.520900965 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.520925045 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.520931005 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.520944118 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.521507025 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.521552086 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.525124073 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.525132895 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.525142908 CEST	49795	443	192.168.2.4	20.114.59.183
Sep 2, 2024 11:15:59.525146961 CEST	443	49795	20.114.59.183	192.168.2.4
Sep 2, 2024 11:15:59.531485081 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.531485081 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050267935 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050301075 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.050353050 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050546885 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050575018 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.050622940 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050748110 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050762892 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.050843954 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050856113 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.481794119 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.482040882 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.482059002 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.482338905 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.482605934 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.482662916 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.489053965 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.489229918 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.489243031 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.489521027 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.489772081 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.489828110 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.531119108 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.531220913 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:06.689580917 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:16:06.689600945 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:16:08.203517914 CEST	49724	80	192.168.2.4	199.232.214.172
Sep 2, 2024 11:16:08.208815098 CEST	80	49724	199.232.214.172	192.168.2.4
Sep 2, 2024 11:16:08.208877087 CEST	49724	80	192.168.2.4	199.232.214.172
Sep 2, 2024 11:16:10.000411034 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:10.000444889 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:10.016042948 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:10.016064882 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:10.016076088 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:10.016083956 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:10.031647921 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:10.031656981 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:14.386404037 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:14.386476040 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:14.386523008 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:14.386552095 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:14.386593103 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:14.386632919 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:17.799761057 CEST	49797	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:17.799787998 CEST	443	49797	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:17.799815893 CEST	49798	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:17.799819946 CEST	443	49798	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:18.399643898 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:18.399724960 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:18.399777889 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:18.404587984 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:18.404642105 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:18.404685974 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:43.047319889 CEST	49770	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:16:43.047334909 CEST	443	49770	142.251.32.110	192.168.2.4
Sep 2, 2024 11:16:43.062597036 CEST	49771	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:16:43.062619925 CEST	443	49771	142.251.32.110	192.168.2.4
Sep 2, 2024 11:16:51.703697920 CEST	49782	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:16:51.703732967 CEST	443	49782	52.123.243.70	192.168.2.4
Sep 2, 2024 11:16:55.001663923 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:55.001701117 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:55.017220020 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:55.017220020 CEST	49757	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:55.017245054 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:55.017252922 CEST	443	49757	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:55.032844067 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:55.032851934 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 11:17:03.406337023 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:03.406368017 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:03.406420946 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:03.406446934 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:06.014662027 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.014688969 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.014821053 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.015248060 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.015261889 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.455620050 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.458945990 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.458962917 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.459291935 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.463072062 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.463140011 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.463208914 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.508493900 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.599061012 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.599112034 CEST	443	49804	23.55.235.170	192.168.2.4
Sep 2, 2024 11:17:06.599210978 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.599392891 CEST	49804	443	192.168.2.4	23.55.235.170
Sep 2, 2024 11:17:06.599412918 CEST	443	49804	23.55.235.170	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 11:15:04.635122061 CEST	53	64322	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:05.352909088 CEST	52501	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:05.353235006 CEST	57370	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:07.850704908 CEST	53	64359	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:07.871417999 CEST	53	59292	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.095232010 CEST	55145	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.095726013 CEST	61970	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.096082926 CEST	62580	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.096225023 CEST	56920	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.096591949 CEST	58006	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.096854925 CEST	54419	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.097341061 CEST	59790	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.097518921 CEST	64230	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.103260994 CEST	53	55145	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.103617907 CEST	53	61970	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.103722095 CEST	53	56920	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.103919029 CEST	53	58006	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.104136944 CEST	53	62580	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.104387999 CEST	53	54419	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.105206966 CEST	53	64230	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.105258942 CEST	53	59790	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.143352985 CEST	53302	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.143546104 CEST	54543	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:08.150158882 CEST	53	53302	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:08.150170088 CEST	53	54543	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:09.336328983 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.361485958 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.641590118 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.672638893 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.763834000 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.763863087 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.763875008 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.763907909 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.763921022 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.764442921 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.766678095 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.766807079 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.767153025 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.767235994 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.767370939 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.767471075 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.788727999 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.788741112 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.788750887 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.788913965 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.789004087 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.789172888 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.790668964 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.790749073 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.791003942 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.791093111 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.860261917 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.860377073 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.860678911 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.862008095 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.862123013 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.862267971 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.862430096 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.862653971 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.862890959 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.862945080 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.863550901 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.863720894 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:09.880707026 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.881023884 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.881216049 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.881828070 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.881836891 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.882009983 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.882864952 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.882982016 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.883091927 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:09.955421925 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:09.972239971 CEST	443	52717	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:09.985124111 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.000499964 CEST	52717	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:10.978988886 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:10.978988886 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:11.073816061 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.074692965 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.075017929 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.075423002 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:11.558810949 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:11.559156895 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:11.653983116 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.654634953 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.654954910 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.655489922 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:11.658730030 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:11.941653013 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:11.941766977 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:12.055027962 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:12.055063009 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:12.055073023 CEST	443	59159	172.64.41.3	192.168.2.4
Sep 2, 2024 11:15:12.055370092 CEST	59159	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:15:12.234728098 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.535763025 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.679869890 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.679884911 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.686157942 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.686170101 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.686299086 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.686499119 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.686523914 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.686619997 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.689759970 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.691109896 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.691226959 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.691641092 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.691695929 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.691869974 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.789535046 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.789554119 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.789561987 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.789570093 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.789819002 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.789956093 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.818130970 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.818290949 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.818519115 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.819041967 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.819050074 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:12.859849930 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:12.914405107 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:19.619276047 CEST	57487	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:19.619443893 CEST	50934	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:19.628180027 CEST	53	57487	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:19.628190994 CEST	53	50934	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:19.798136950 CEST	138	138	192.168.2.4	192.168.2.255
Sep 2, 2024 11:15:20.892903090 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.010286093 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:21.010409117 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:21.109608889 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:21.143743992 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:21.170012951 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:21.171453953 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:21.171696901 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:21.215934992 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.256825924 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:21.292880058 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:21.324800968 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:21.329988956 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:21.402618885 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.403671980 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.580576897 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.580590963 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.580601931 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.580611944 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.582056046 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.582272053 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.583398104 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.587698936 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.588021040 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.588779926 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.759517908 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.759530067 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.759540081 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.760396957 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.789747000 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.931592941 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.971189022 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.982677937 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982690096 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982701063 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982712030 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982865095 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982920885 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982964039 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.982975960 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.983027935 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.983087063 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.983098984 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:21.983424902 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.983676910 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.983676910 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.983783960 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.983813047 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:21.984030962 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:22.160418034 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:22.200556040 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:22.370980024 CEST	443	65354	52.123.243.70	192.168.2.4
Sep 2, 2024 11:15:22.407330990 CEST	65354	443	192.168.2.4	52.123.243.70
Sep 2, 2024 11:15:22.652949095 CEST	53	50404	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:23.268624067 CEST	50036	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:23.268906116 CEST	57224	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:23.269285917 CEST	58578	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:23.269480944 CEST	56346	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:23.276416063 CEST	53	50036	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:23.276581049 CEST	53	57224	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:23.277147055 CEST	53	56346	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:23.277156115 CEST	53	58578	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:23.479222059 CEST	55523	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:23.479378939 CEST	62932	53	192.168.2.4	1.1.1.1
Sep 2, 2024 11:15:23.486102104 CEST	53	55523	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:23.486156940 CEST	53	62932	1.1.1.1	192.168.2.4
Sep 2, 2024 11:15:37.741113901 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.046883106 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.332173109 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.332195044 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.332304955 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.332319975 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.332330942 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:38.332719088 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.334789038 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.335119009 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.335408926 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.335683107 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.347531080 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.754201889 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.754362106 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.754991055 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.755037069 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:38.907876015 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:39.412092924 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412122965 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412134886 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412142992 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412151098 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412154913 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412158966 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412168026 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412177086 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.412596941 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:39.412648916 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:39.412806034 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:39.413156033 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.414985895 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.414994001 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.415144920 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:39.454582930 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:39.509062052 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.509071112 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:39.509377956 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:41.752651930 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:41.752652884 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:41.754045963 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:41.850157976 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:41.874492884 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:41.874712944 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:41.877875090 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:41.877923965 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:41.878191948 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:41.878308058 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:41.878382921 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:41.878632069 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:41.879250050 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:42.064604998 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:42.164767027 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:42.361717939 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:42.394800901 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:42.394810915 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:42.394854069 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:42.395107985 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:42.423602104 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:42.442760944 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:42.442913055 CEST	54491	443	192.168.2.4	142.251.32.110
Sep 2, 2024 11:15:42.488054991 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:42.490675926 CEST	443	54491	142.251.32.110	192.168.2.4
Sep 2, 2024 11:15:56.326828957 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.326967001 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.327126980 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.327225924 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.656441927 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.775780916 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.775796890 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.775806904 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.775814056 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.775818110 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.776355028 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.776441097 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.776508093 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.776536942 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.866926908 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.866940975 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.885145903 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:56.978696108 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.979469061 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:56.979551077 CEST	443	64714	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.016356945 CEST	64714	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:57.456288099 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:57.470537901 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:57.741426945 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.741564035 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.741657972 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.742554903 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:57.742809057 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:58.728669882 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:58.729198933 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:58.730360031 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.008722067 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.008733988 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.008743048 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.008769989 CEST	443	58983	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.009222031 CEST	58983	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.034215927 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.155476093 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.155498981 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.155582905 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.155592918 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.155602932 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.156266928 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.158935070 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.159215927 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.159298897 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.159570932 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.159642935 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.249404907 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.249499083 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.249507904 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.249514103 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.249943972 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.250082970 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.250773907 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.252019882 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.252044916 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.252203941 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:15:59.344471931 CEST	443	65533	162.159.61.3	192.168.2.4
Sep 2, 2024 11:15:59.376913071 CEST	65533	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.050079107 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.359421015 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.474024057 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.474039078 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.474417925 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.474430084 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.474442959 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.474455118 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.474751949 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.476270914 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.476596117 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.476696014 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.476963043 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.477121115 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.567560911 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.567667007 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.567677021 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.567686081 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.567966938 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.568032026 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.568612099 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.569396019 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.569713116 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.569833994 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:03.658421040 CEST	443	62332	162.159.61.3	192.168.2.4
Sep 2, 2024 11:16:03.710724115 CEST	62332	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:16:12.458240986 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.458362103 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.458645105 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.458739996 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.784359932 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.908421993 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:12.908446074 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:12.908463001 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:12.908474922 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:12.908497095 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:12.909158945 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.909158945 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.909198999 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:12.909235954 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:13.002573967 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.002593040 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.002980947 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:13.097659111 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.098454952 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.098562956 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.098855019 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:13.099446058 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.099566936 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.549061060 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.549096107 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.549597979 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.549757004 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.550235033 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.550257921 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.550349951 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.550362110 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.571808100 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.645061970 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.645081997 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.645097017 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.645108938 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.645379066 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.665960073 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.668646097 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.668850899 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.669079065 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.670685053 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.670825958 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.671011925 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.709256887 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:13.760839939 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:13.879673004 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:13.879756927 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:13.975811005 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.976402044 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.976774931 CEST	443	58371	172.64.41.3	192.168.2.4
Sep 2, 2024 11:16:13.976922035 CEST	58371	443	192.168.2.4	172.64.41.3
Sep 2, 2024 11:16:13.977588892 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:13.977632046 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.415509939 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.415919065 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.416059017 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.416069984 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.416079998 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.416254044 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.416788101 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.416979074 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.512413025 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.512516022 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.512583971 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.512728930 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.548212051 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.568312883 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.568335056 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.568345070 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:14.568671942 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.568746090 CEST	51693	443	192.168.2.4	142.251.163.84
Sep 2, 2024 11:16:14.690610886 CEST	443	51693	142.251.163.84	192.168.2.4
Sep 2, 2024 11:16:42.520111084 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:42.612838984 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:42.613377094 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:42.613440990 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:42.642352104 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:42.645745039 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:42.703722000 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:42.731211901 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:42.731862068 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:42.731862068 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:42.767441034 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:42.847317934 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:43.377696037 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:43.377728939 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:43.468082905 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:43.497581959 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:43.498089075 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:43.512861967 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:43.558178902 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:16:43.628465891 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:43.643874884 CEST	443	61001	142.251.40.110	192.168.2.4
Sep 2, 2024 11:16:43.669503927 CEST	61001	443	192.168.2.4	142.251.40.110
Sep 2, 2024 11:17:05.363405943 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.363559961 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.363781929 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.363888979 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.737545013 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.795546055 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.796895981 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.827625036 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.827636003 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.827642918 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.827651024 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.828490973 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.828555107 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.828589916 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:05.886388063 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.918214083 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:05.920913935 CEST	57489	443	192.168.2.4	162.159.61.3
Sep 2, 2024 11:17:06.011564016 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:06.012070894 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:06.013248920 CEST	443	57489	162.159.61.3	192.168.2.4
Sep 2, 2024 11:17:06.013601065 CEST	57489	443	192.168.2.4	162.159.61.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 2, 2024 11:15:05.352909088 CEST	192.168.2.4	1.1.1.1	0x3cd9	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:05.353235006 CEST	192.168.2.4	1.1.1.1	0xceb1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 2, 2024 11:15:08.095232010 CEST	192.168.2.4	1.1.1.1	0xc75a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.095726013 CEST	192.168.2.4	1.1.1.1	0xc4ed	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:08.096082926 CEST	192.168.2.4	1.1.1.1	0x21da	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.096225023 CEST	192.168.2.4	1.1.1.1	0x1cc6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:08.096591949 CEST	192.168.2.4	1.1.1.1	0xfd75	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.096854925 CEST	192.168.2.4	1.1.1.1	0xf624	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:08.097341061 CEST	192.168.2.4	1.1.1.1	0xbdae	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.097518921 CEST	192.168.2.4	1.1.1.1	0x5c52	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:08.143352985 CEST	192.168.2.4	1.1.1.1	0x199e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.143546104 CEST	192.168.2.4	1.1.1.1	0xc96b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:19.619276047 CEST	192.168.2.4	1.1.1.1	0x5f60	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:19.619443893 CEST	192.168.2.4	1.1.1.1	0x58cb	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:23.268624067 CEST	192.168.2.4	1.1.1.1	0xa86c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.268906116 CEST	192.168.2.4	1.1.1.1	0x6f3e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:23.269285917 CEST	192.168.2.4	1.1.1.1	0x589d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.269480944 CEST	192.168.2.4	1.1.1.1	0x88fb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 11:15:23.479222059 CEST	192.168.2.4	1.1.1.1	0xda67	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.479378939 CEST	192.168.2.4	1.1.1.1	0x3e3b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 2, 2024 11:15:05.360589981 CEST	1.1.1.1	192.168.2.4	0xceb1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:05.360604048 CEST	1.1.1.1	192.168.2.4	0x3cd9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:08.013236046 CEST	1.1.1.1	192.168.2.4	0xa34c	No error (0)	shed.dual-low.s-part-0045.t-0009.t-msedge.net	s-part-0045.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:08.013236046 CEST	1.1.1.1	192.168.2.4	0xa34c	No error (0)	s-part-0045.t-0009.t-msedge.net		13.107.246.73	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.103260994 CEST	1.1.1.1	192.168.2.4	0xc75a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.103260994 CEST	1.1.1.1	192.168.2.4	0xc75a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.103617907 CEST	1.1.1.1	192.168.2.4	0xc4ed	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:08.103722095 CEST	1.1.1.1	192.168.2.4	0x1cc6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:08.103919029 CEST	1.1.1.1	192.168.2.4	0xfd75	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.103919029 CEST	1.1.1.1	192.168.2.4	0xfd75	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.104136944 CEST	1.1.1.1	192.168.2.4	0x21da	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.104136944 CEST	1.1.1.1	192.168.2.4	0x21da	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.104387999 CEST	1.1.1.1	192.168.2.4	0xf624	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:08.105206966 CEST	1.1.1.1	192.168.2.4	0x5c52	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:08.105258942 CEST	1.1.1.1	192.168.2.4	0xbdae	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.105258942 CEST	1.1.1.1	192.168.2.4	0xbdae	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.150158882 CEST	1.1.1.1	192.168.2.4	0x199e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.150158882 CEST	1.1.1.1	192.168.2.4	0x199e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:08.150170088 CEST	1.1.1.1	192.168.2.4	0xc96b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.70	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.217	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.81	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.91	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.76	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.88	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.192	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:18.448156118 CEST	1.1.1.1	192.168.2.4	0xc528	No error (0)	svc.ha-teams.office.com		52.123.243.71	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:19.619638920 CEST	1.1.1.1	192.168.2.4	0x9b6b	No error (0)	shed.dual-low.s-part-0045.t-0009.t-msedge.net	s-part-0045.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:19.619638920 CEST	1.1.1.1	192.168.2.4	0x9b6b	No error (0)	s-part-0045.t-0009.t-msedge.net		13.107.246.73	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:19.628180027 CEST	1.1.1.1	192.168.2.4	0x5f60	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:19.628180027 CEST	1.1.1.1	192.168.2.4	0x5f60	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:19.628190994 CEST	1.1.1.1	192.168.2.4	0x58cb	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:20.774993896 CEST	1.1.1.1	192.168.2.4	0x1a26	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:20.775454044 CEST	1.1.1.1	192.168.2.4	0xa473	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:20.775454044 CEST	1.1.1.1	192.168.2.4	0xa473	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:21.800060987 CEST	1.1.1.1	192.168.2.4	0xa792	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:21.800060987 CEST	1.1.1.1	192.168.2.4	0xa792	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:21.800674915 CEST	1.1.1.1	192.168.2.4	0x519e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:23.276416063 CEST	1.1.1.1	192.168.2.4	0xa86c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.276416063 CEST	1.1.1.1	192.168.2.4	0xa86c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.276581049 CEST	1.1.1.1	192.168.2.4	0x6f3e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:23.277147055 CEST	1.1.1.1	192.168.2.4	0x88fb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:23.277156115 CEST	1.1.1.1	192.168.2.4	0x589d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.277156115 CEST	1.1.1.1	192.168.2.4	0x589d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.486102104 CEST	1.1.1.1	192.168.2.4	0xda67	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.486102104 CEST	1.1.1.1	192.168.2.4	0xda67	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:23.486156940 CEST	1.1.1.1	192.168.2.4	0x3e3b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 11:15:23.822693110 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:23.822693110 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:24.835601091 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:24.835601091 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:25.858547926 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:25.858547926 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:27.928127050 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:27.928127050 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:31.911792994 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:31.911792994 CEST	1.1.1.1	192.168.2.4	0xd23c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:39.420526028 CEST	1.1.1.1	192.168.2.4	0xfb46	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:39.420754910 CEST	1.1.1.1	192.168.2.4	0x83fb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:39.420754910 CEST	1.1.1.1	192.168.2.4	0x83fb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:39.774491072 CEST	1.1.1.1	192.168.2.4	0xfc7f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:39.774491072 CEST	1.1.1.1	192.168.2.4	0xfc7f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:39.776212931 CEST	1.1.1.1	192.168.2.4	0x10c9	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:41.807010889 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:41.807010889 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:42.805789948 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:42.805789948 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:43.806154966 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:43.806154966 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:45.820164919 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:45.820164919 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 11:15:49.820559978 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 11:15:49.820559978 CEST	1.1.1.1	192.168.2.4	0x4155	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

arc.msn.com

fs.microsoft.com

https:

www.google.com

config.edge.skype.com

clients2.googleusercontent.com

slscr.update.microsoft.com

bzib.nelreports.net

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49750	172.64.41.3	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc64d2ede68c30-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49751	162.159.61.3	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc64d2dff08c59-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 db 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	162.159.61.3	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc64d2dbd10c96-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 df 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	162.159.61.3	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc64d308490cd9-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e8 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49753	172.64.41.3	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc64d3492a41c1-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 eb 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	13.107.246.73	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:08 UTC	538	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240902T091508Z-16579567576j7nvvu5n0ytgs1c00000007rg00000000f9ex Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-02 09:15:08 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	13.107.246.73	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:08 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:08 UTC	562	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 09:15:08 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240902T091508Z-16579567576xfl5xzh7yws029s00000007pg000000006m6d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-02 09:15:08 UTC	15822	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-02 09:15:08 UTC	16384	IN	Data Raw: 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 Data Ascii: 0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-09-02 09:15:08 UTC	16384	IN	Data Raw: 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-09-02 09:15:08 UTC	16384	IN	Data Raw: d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 Data Ascii: .7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-09-02 09:15:08 UTC	5233	IN	Data Raw: 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 Data Ascii: yVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49762	20.96.153.111	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:10 UTC	617	OUT	GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=-6563510624502596580&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1 Host: arc.msn.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:10 UTC	633	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400, private Content-Length: 2065 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"X-RADID":"P425775005-T700421790-C128000000003081829"},{"BATCH_REDIRECT_STORE":"B128000000003081829+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 02 Sep 2024 09:15:09 GMT Connection: close
2024-09-02 09:15:10 UTC	2065	IN	Data Raw: 7b 22 66 22 3a 22 72 61 66 22 2c 22 76 22 3a 22 31 2e 30 22 2c 22 72 64 72 22 3a 5b 7b 22 63 22 3a 22 41 6e 61 68 65 69 6d 20 50 61 73 73 77 6f 72 64 20 4d 6f 6e 69 74 6f 72 22 2c 22 75 22 3a 22 43 6f 6e 73 65 6e 74 20 53 61 76 65 20 50 61 73 73 77 6f 72 64 22 7d 5d 2c 22 61 64 22 3a 7b 22 54 49 54 4c 45 5f 53 41 56 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 55 50 44 41 54 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 4e 4f 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 Data Ascii: {"f":"raf","v":"1.0","rdr":[{"c":"Anaheim Password Monitor","u":"Consent Save Password"}],"ad":{"TITLE_SAVE":"Save your password","TITLE_UPDATE":"Save your password","TITLE_SAVED_PASSWORD":"Save your password","TITLE_NO_SAVED_PASSWORD":"Save your password

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-02 09:15:10 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=113430 Date: Mon, 02 Sep 2024 09:15:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49766	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-02 09:15:11 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=113429 Date: Mon, 02 Sep 2024 09:15:11 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-02 09:15:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49767	142.251.32.110	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:12 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-02 09:15:12 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 02 Sep 2024 09:15:12 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49768	142.251.32.110	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:12 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-02 09:15:12 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 02 Sep 2024 09:15:12 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49769	142.250.65.228	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:12 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-02 09:15:12 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 02 Sep 2024 09:00:01 GMT Expires: Tue, 10 Sep 2024 09:00:01 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 911 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-02 09:15:12 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-02 09:15:12 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-02 09:15:12 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-02 09:15:12 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-02 09:15:12 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49772	52.123.243.70	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:19 UTC	691	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=8684241135348538038&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=3&mngd=0&installdate=1696333686&edu=0&bphint=2&soobedate=1696333682&fg=0 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "fhn6qsQvjeSiYMQxYRE0o4SWV0go1Y2PM5yzaMM3dVw=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-09-02 09:15:19 UTC	1175	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 735 Content-Type: application/json Expires: Mon, 02 Sep 2024 10:15:19 GMT ETag: "1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI=" Server: Microsoft-IIS/10.0 request-id: 5226c586-42cf-b213-024f-7ebb05002577 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-SIP-FR3&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 5226c586-42cf-b213-024f-7ebb05002577 FR3P281CA0062 2024-09-02T09:15:19.592Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR3P281CA0062.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-Powered-By: ASP.NET X-FEServer: FR3P281CA0062 Date: Mon, 02 Sep 2024 09:15:18 GMT Connection: close
2024-09-02 09:15:19 UTC	735	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 46 69 72 73 74 52 75 6e 43 6f 6e 66 69 67 22 3a 7b 22 45 6d 70 74 79 45 64 67 65 46 69 72 73 74 52 75 6e 43 6f 6e 66 69 67 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 65 65 66 72 63 22 5d 7d 7d 2c 22 53 65 67 6d 65 6e 74 61 74 69 6f 6e 22 3a 7b 22 57 57 45 41 6c 6c 22 3a 22 66 61 6c 73 65 22 2c 22 73 63 70 66 75 6c 6c 22 3a 30 2c 22 73 63 70 67 75 61 72 64 22 3a 30 2c 22 73 63 70 76 65 72 22 3a 30 2c 22 4d 33 36 35 43 6f 72 65 41 6c 6c 22 3a 22 66 61 6c 73 65 22 2c 22 43 6f 6e 74 65 6e 74 Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"EdgeFirstRunConfig":{"EmptyEdgeFirstRunConfig":{"enableFeatures":["eefrc"]}},"Segmentation":{"WWEAll":"false","scpfull":0,"scpguard":0,"scpver":0,"M365CoreAll":"false","Content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49780	142.250.186.65	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:20 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:20 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljubM27y9AJLGpx84pz5hnpgnwtjZIJd7bxjPlhpHEGx4gTvOqSC4i3RtvorcqhSLsHexmw X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Sun, 01 Sep 2024 19:15:10 GMT Expires: Mon, 01 Sep 2025 19:15:10 GMT Cache-Control: public, max-age=31536000 Age: 50410 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-02 09:15:20 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-02 09:15:20 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49779	13.107.246.73	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:20 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:20 UTC	538	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 09:15:20 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240902T091520Z-165795675767jvm9z21nmtw4wn00000007fg0000000069vp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-02 09:15:20 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49777	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ctgSZvpLOwdTR7k&MD=yoeRGFk+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-02 09:15:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: fd00994f-ac2c-40b1-bae6-4b1eede2f9cf MS-RequestId: 05b0d648-b3b9-404e-b455-7e17744e3190 MS-CV: j75uPeG6AEuADfj9.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Sep 2024 09:15:20 GMT Connection: close Content-Length: 24490
2024-09-02 09:15:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-02 09:15:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49789	162.159.61.3	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc653229c37cae-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49788	162.159.61.3	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc65323a2743c4-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49790	172.64.41.3	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 09:15:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 09:15:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 09:15:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcc65330aad1770-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 09:15:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0e 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49793	23.200.0.42	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:57 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 471 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:57 UTC	471	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 31 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e 67 2e 63 6f Data Ascii: [{"age":11,"body":{"elapsed_time":712,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bing.co
2024-09-02 09:15:57 UTC	379	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Mon, 02 Sep 2024 09:15:57 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1725268557.2c239c0f Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-02 09:15:57 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49794	152.195.19.97	443	7652	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:58 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725873320&P2=404&P3=2&P4=lsqihl2fTDQHt5vqivN5wJm8R1SdcFQX1xerAbZSdUq%2f9%2bJCmCGfNUFEorwuc4Ywy0xoMQJSOTw%2fAWyRE1A2Ow%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: bt3yxtfbhMFk3omQJr4mrE Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:15:58 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5195089 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 02 Sep 2024 09:15:58 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-02 09:15:58 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49795	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:15:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ctgSZvpLOwdTR7k&MD=yoeRGFk+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-02 09:15:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: f0c9f1f0-e148-41f3-9a03-bff11a94b597 MS-RequestId: 9f8ae1d5-cb01-4820-9568-6e8515ef5cff MS-CV: 4u/hmQY5+E6rejT3.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Sep 2024 09:15:58 GMT Connection: close Content-Length: 30005
2024-09-02 09:15:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-02 09:15:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49804	23.55.235.170	443	7996	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 09:17:06 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 09:17:06 UTC	379	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Mon, 02 Sep 2024 09:17:06 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.a6eb3717.1725268626.1271e2f9 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-02 09:17:06 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Target ID:	0
Start time:	05:15:00
Start date:	02/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6d0000
File size:	917'504 bytes
MD5 hash:	02F05A4F911BD2DA08549F1EEC6EA277
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:15:00
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:15:01
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1996,i,9922448481746041504,14044685848515789900,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:15:01
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:15:01
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:15:05
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3348 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:15:05
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7328 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0xd80000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:15:06
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7d0880000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:15:06
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=2040,i,11974780244536428547,276780697641856495,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7d0880000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:15:16
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:15:16
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2860 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:15:17
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4572 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:15:18
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8
Imagebase:	0x7ff7d0880000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:15:18
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2392,i,4037846104754272402,14389313524374843009,262144 /prefetch:8
Imagebase:	0x7ff7d0880000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:15:24
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:15:25
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2068,i,10994573958284707532,12861527657539237618,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:15:32
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:15:32
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2140,i,13012278448354238983,3491655061460600158,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:15:45
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:15:46
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,17889571995580524857,8444313851129401253,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1381
Total number of Limit Nodes:	56

Executed Functions

Function 006EF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 006EF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0072F474
IsIconic.USER32(00000000), ref: 0072F47D
ShowWindow.USER32(00000000,00000009), ref: 0072F48A
SetForegroundWindow.USER32(00000000), ref: 0072F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0072F4AA
GetCurrentThreadId.KERNEL32 ref: 0072F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0072F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0072F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0072F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0072F4DE
SetForegroundWindow.USER32(00000000), ref: 0072F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F4F6
keybd_event.USER32(00000012,00000000), ref: 0072F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F50B
keybd_event.USER32(00000012,00000000), ref: 0072F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F519
keybd_event.USER32(00000012,00000000), ref: 0072F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F528
keybd_event.USER32(00000012,00000000), ref: 0072F52D
SetForegroundWindow.USER32(00000000), ref: 0072F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0072F557

Strings

Shell_TrayWnd, xrefs: 0072F46F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 17de642866ee97a1ccacce39f5d04e374aea8e4a31b135403823bef0630b0f23
Instruction ID: 926c1e45b0aee2b34e01e9e6b845a478888befba4b1de5e980da59b5c3e4829e
Opcode Fuzzy Hash: 17de642866ee97a1ccacce39f5d04e374aea8e4a31b135403823bef0630b0f23
Instruction Fuzzy Hash: F2319671A403187BEB216FB65C4AFBF7E7CEB44B50F204065F602E61D1C6F55D10AA64

Function 006D42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 006D430D

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetCurrentProcess.KERNEL32(?,0076CB64,00000000,?,?), ref: 006D4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 006D4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 006D4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 006D4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 006D4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 006D447B
GetSystemInfo.KERNEL32(?,?,?), ref: 006D44A0

Strings

|O, xrefs: 007136F8
GetNativeSystemInfo, xrefs: 006D4460
kernel32.dll, xrefs: 006D444F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction ID: 569a3738feeeae290c9a7606aa7d775ee12e45a2e80a7a97d16c6f5d36e87631
Opcode Fuzzy Hash: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction Fuzzy Hash: 1AA1A465D0A2C0DFEF12CF6D78801E57FE5ABA7340F88C89AD08197B61D67C4949CB29

Function 006D42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42C9
LoadResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135BE
SizeofResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135D3
LockResource.KERNEL32(006D50AA,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20,?), ref: 007135E6

Strings

SCRIPT, xrefs: 006D42BF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction ID: 8f7659fde18478b6f866f0df50208c0ada4bf0b7bd2b3275a48622568657523e
Opcode Fuzzy Hash: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction Fuzzy Hash: BB117C70600701BFE7228B65DC49F677BBAEFC5B51F10816AF847D6290DBB1DD008660

Function 00712BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00792224), ref: 00712C10
ShellExecuteW.SHELL32(00000000,?,?,00792224), ref: 00712C17

Strings

runas, xrefs: 00712C0B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 4e457e84b0337f6b2def289b8948fb577cca41b27f07d399df9512ccb59c3a60
Instruction ID: d643540db0769af3fb9bac1b6c5997cb7f89ac590afa182eb39c11fd9de8d72d
Opcode Fuzzy Hash: 4e457e84b0337f6b2def289b8948fb577cca41b27f07d399df9512ccb59c3a60
Instruction Fuzzy Hash: 28112C31E083915AD755FF64D8519BE7BA69FE5744F44442FF082023A3CF68894AC71B

Function 0073DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00715222), ref: 0073DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0073DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0073DBEE
FindClose.KERNEL32(00000000), ref: 0073DBFA

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 72eac06d1bf322ed8667c13715d8a6a76d7f68eff1fb54395183526af14965d0
Instruction ID: 643c8daf687ae83e39368bfd93b56a5a334912e88e81bdc431b8eb0b8de2b057
Opcode Fuzzy Hash: 72eac06d1bf322ed8667c13715d8a6a76d7f68eff1fb54395183526af14965d0
Instruction Fuzzy Hash: BFF0A7704206145FA2316B78AC0D47A776CAE01334F108702F876C10E1EBF89D5485AA

Function 0075AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0075B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1D4
_wcslen.LIBCMT ref: 0075B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B236
_wcslen.LIBCMT ref: 0075B332

Part of subcall function 007405A7: GetStdHandle.KERNEL32(000000F6), ref: 007405C6

_wcslen.LIBCMT ref: 0075B34B
_wcslen.LIBCMT ref: 0075B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0075B3B6
GetLastError.KERNEL32(00000000), ref: 0075B407
CloseHandle.KERNEL32(?), ref: 0075B439
CloseHandle.KERNEL32(00000000), ref: 0075B44A
CloseHandle.KERNEL32(00000000), ref: 0075B45C
CloseHandle.KERNEL32(00000000), ref: 0075B46E
CloseHandle.KERNEL32(?), ref: 0075B4E3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 2a8fdc36247c33896afd7fb7ed6265d4308f1fa86555b21ff44f3a5b8df93ed4
Instruction ID: 8a069dc9506b9730d9e87a6e3fe8491c36a3174ce7ac5b834e27a111a506f05e
Opcode Fuzzy Hash: 2a8fdc36247c33896afd7fb7ed6265d4308f1fa86555b21ff44f3a5b8df93ed4
Instruction Fuzzy Hash: C7F18C31604340DFC764EF24C891B6EBBE1AF85310F14855EF8999B2A2DB75EC48CB96

Function 006DD730 Relevance: 21.6, APIs: 14, Instructions: 627sleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 006DD807
timeGetTime.WINMM ref: 006DDA07
Sleep.KERNELBASE(0000000A), ref: 006DDBB1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 63bb81ae776753763e8abf1c1cbeab6a52ca00edb994e9f41a5a8999f80781fa
Instruction ID: 5a069a0b059f65590e8d978a29e9aa72318cd83de11aca0ebc9c769064dfa5ce
Opcode Fuzzy Hash: 63bb81ae776753763e8abf1c1cbeab6a52ca00edb994e9f41a5a8999f80781fa
Instruction Fuzzy Hash: EB423670A04341EFD725EF24C844BAAB7E2BF86304F14851EF8568B392D779E845CB92

Function 006D2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2D07
RegisterClassExW.USER32(00000030), ref: 006D2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
LoadIconW.USER32(000000A9), ref: 006D2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

TaskbarCreated, xrefs: 006D2D37
AutoIt v3 GUI, xrefs: 006D2D23
+, xrefs: 006D2CF0
0, xrefs: 006D2CE9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction ID: d41e656721f8152c92dd79ceb61baa6bd4ecab2fdab06af11c530d46052495e0
Opcode Fuzzy Hash: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction Fuzzy Hash: 712127B0901358AFEB01DFA4EC48BEEBBB4FB48700F00811AF552A62A0D7B91544CF99

Function 0071065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071039A: CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

GetLastError.KERNEL32 ref: 0071076F
__dosmaperr.LIBCMT ref: 00710776
GetFileType.KERNELBASE(00000000), ref: 00710782
GetLastError.KERNEL32 ref: 0071078C
__dosmaperr.LIBCMT ref: 00710795
CloseHandle.KERNEL32(00000000), ref: 007107B5
CloseHandle.KERNEL32(?), ref: 007108FF
GetLastError.KERNEL32 ref: 00710931
__dosmaperr.LIBCMT ref: 00710938

Strings

H, xrefs: 007108BD

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction ID: de18356d564fffede57596023328c43ca7459cb933514b6fe10b67b89811eae9
Opcode Fuzzy Hash: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction Fuzzy Hash: 17A14332A001088FDF19AF6CD895BEE3BA1AF46320F14415DF811AB3D1C7799992CBD5

Function 006D344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006D3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006D356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0071318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007131CE
RegCloseKey.ADVAPI32(?), ref: 00713210
_wcslen.LIBCMT ref: 00713277
_wcslen.LIBCMT ref: 00713286

Strings

Software\AutoIt v3\AutoIt, xrefs: 006D3560
\Include\, xrefs: 006D3527
Include, xrefs: 00713184, 007131C5
\, xrefs: 0071328C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 8b60e10871f5e68241308adfb0d0f31f87535c6583ba232d65a73ebbe859eb87
Instruction ID: dc0eb2053d3abf49d6fd92b1ba64864e9878e76d5ca4e9013eeafbc660286080
Opcode Fuzzy Hash: 8b60e10871f5e68241308adfb0d0f31f87535c6583ba232d65a73ebbe859eb87
Instruction Fuzzy Hash: A571B6715043009FC744EF69DC418ABBBE8FF86740F40842EF545872B1EB789A49CB59

Function 006D2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 006D2B9D
LoadIconW.USER32(00000063), ref: 006D2BB3
LoadIconW.USER32(000000A4), ref: 006D2BC5
LoadIconW.USER32(000000A2), ref: 006D2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 006D2BEF
RegisterClassExW.USER32(?), ref: 006D2C40

Part of subcall function 006D2CD4: GetSysColorBrush.USER32(0000000F), ref: 006D2D07
Part of subcall function 006D2CD4: RegisterClassExW.USER32(00000030), ref: 006D2D31
Part of subcall function 006D2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
Part of subcall function 006D2CD4: InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
Part of subcall function 006D2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
Part of subcall function 006D2CD4: LoadIconW.USER32(000000A9), ref: 006D2D85
Part of subcall function 006D2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

#, xrefs: 006D2C16
0, xrefs: 006D2C0F
AutoIt v3, xrefs: 006D2C2F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction ID: 7553c93a847984972d24c8f2b4edff7a2396c84a6737d1a18b6c23467bec22d9
Opcode Fuzzy Hash: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction Fuzzy Hash: A7213874E00328AFEF119FA5EC55AA97FF4FB89B50F40802AE505A66A0D3B90540CF98

Function 006DB710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006DBB4E

Strings

p#z, xrefs: 006DBB6B
p#z, xrefs: 006DBA72
p#z, xrefs: 0072024F
p#z, xrefs: 00720263
x#z, xrefs: 00720168
x#z, xrefs: 00720207
p%z, xrefs: 006DB8DC
p%z, xrefs: 006DBB32

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#z$p#z$p#z$p#z$p%z$p%z$x#z$x#z
API String ID: 1385522511-1284704788
Opcode ID: 066304d49a17715801171b9e48387d66fdeca6b960b63c0171af949411af958d
Instruction ID: 721285d8659759c0c7bd81cec89dafe187ed59db21ee90547f6f82226ab269af
Opcode Fuzzy Hash: 066304d49a17715801171b9e48387d66fdeca6b960b63c0171af949411af958d
Instruction Fuzzy Hash: 1C329D34E00219DFDB14CF58C894ABEB7B6FF46310F16805AE915AB356C778AD42CBA1

Function 006D3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,006D316A,?,?), ref: 006D31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,006D316A,?,?), ref: 006D3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006D3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,006D316A,?,?), ref: 006D3232
CreatePopupMenu.USER32 ref: 006D3246
PostQuitMessage.USER32(00000000), ref: 006D3267

Strings

TaskbarCreated, xrefs: 006D322D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 6e64a3d7810ccf1134e4c719745f5b1c9a230bc79054236fef289f36023ce565
Instruction ID: 317a016b31a23cfbf3fec66c0101b0bc463eafdfe01ad8dcbd26cf9c7b3828b7
Opcode Fuzzy Hash: 6e64a3d7810ccf1134e4c719745f5b1c9a230bc79054236fef289f36023ce565
Instruction Fuzzy Hash: A2414C35E00261A7EF151F789C0D7B9361BE786340F048127F542853E2C7AE9B4197AB

Function 006D2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006D2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006D2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CCF

Strings

edit, xrefs: 006D2CAC
AutoIt v3, xrefs: 006D2C89, 006D2C8E, 006D2C8F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction ID: 787d24c39cf6fb796c215e81ff7ac9d04635382443816d346e496bd3e0d5c981
Opcode Fuzzy Hash: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction Fuzzy Hash: A2F0DA765403A07AFB311B17AC08E773EBDD7C7F61F40805AF900A29A0C6A91850DEB8

Function 0073E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0073E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0073E9A5
Sleep.KERNEL32(00000000), ref: 0073E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0073E9B7
Sleep.KERNELBASE ref: 0073E9F3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: a062e0d54be5c442c9925c6900f1223f570fe923241d70a759d714fcdf92453e
Instruction ID: bc16ca5fbcbd681ea97c12ba5cb0701679c4cc1ded00a66a9ac2e129a9a9d960
Opcode Fuzzy Hash: a062e0d54be5c442c9925c6900f1223f570fe923241d70a759d714fcdf92453e
Instruction Fuzzy Hash: ED015B71C0162DDBDF04ABE4DC596EDBB78BB09301F004546E542B2282DB78A5518766

Function 006D3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B83

Strings

Control Panel\Mouse, xrefs: 006D3B3E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2a1ac18a7148543ce1773203751be109abdcc8a83c13f953537b7875f6a4ae53
Instruction ID: a016f2bcac2245288c30e5814549a6a72c063dfa92362300d28b2eb19b8a528d
Opcode Fuzzy Hash: 2a1ac18a7148543ce1773203751be109abdcc8a83c13f953537b7875f6a4ae53
Instruction Fuzzy Hash: 64112AB5910218FFDB218FA5DC44AEEB7B9EF24744B10846BE845D7310E2719E409765

Function 006D3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007133A2

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 006D3A04

Strings

Line: , xrefs: 007133EB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 4bfd199826d3d69ca73db57f85a27ffa05d103787cf0cabe9a19134951b985f8
Instruction ID: 0354fac024e60cba6414f79df7e83547fb0b576bcdba87e76b01c74a7e09d29a
Opcode Fuzzy Hash: 4bfd199826d3d69ca73db57f85a27ffa05d103787cf0cabe9a19134951b985f8
Instruction Fuzzy Hash: 6531E171908324AED761EF20DC45BEBB7D9AB81710F00492FF59982391EB749A48C7DB

Function 006D2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00712C8C

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 006D2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Strings

`ey, xrefs: 00712C85
X, xrefs: 00712C5A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ey
API String ID: 779396738-2559956516
Opcode ID: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction ID: f3acd069783520a3427f4d5b7f73361928434ce1b4181c12e51c1640b2e94f7e
Opcode Fuzzy Hash: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction Fuzzy Hash: 8F21D571E002989FCF41EF94D805BEE7BFDAF49304F00805AE505A7381DBB85A898FA5

Function 006EFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 006F0668

Part of subcall function 006F32A4: RaiseException.KERNEL32(?,?,?,006F068A,?,007A1444,?,?,?,?,?,?,006F068A,006D1129,00798738,006D1129), ref: 006F3304

__CxxThrowException@8.LIBVCRUNTIME ref: 006F0685

Strings

Unknown exception, xrefs: 006F0692

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 9624c099be955ac27282aee6e8feb6b4d6941a1a7faf43a8a943944316501cc5
Instruction ID: b9d73844da9c657c03d5d666fbaf22f2a80c3876ad2761b0dae18602de265253
Opcode Fuzzy Hash: 9624c099be955ac27282aee6e8feb6b4d6941a1a7faf43a8a943944316501cc5
Instruction Fuzzy Hash: 81F0AF2490030D678F40BBA5EC46CBE7B6E5E40350B604139BA14D6697EF71EA268685

Function 006D10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Part of subcall function 006D1B4A: RegisterWindowMessageW.USER32(00000004,?,006D12C4), ref: 006D1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006D136A
OleInitialize.OLE32 ref: 006D1388
CloseHandle.KERNEL32(00000000,00000000), ref: 007124AB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 472f2449b54991a06a924c3b06222a9e312b0a970523f5c0e5199e84b2187fe5
Instruction ID: 9f17bce51822351b02d89f9c5d9e550283cde2b9cd763b378b77b8fce3830cc7
Opcode Fuzzy Hash: 472f2449b54991a06a924c3b06222a9e312b0a970523f5c0e5199e84b2187fe5
Instruction Fuzzy Hash: 0771ADB8D053508EE388DF79A8556653AE1BBCB394B84C22ED41ACB361EB3C4450CF4D

Function 0073C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 006D3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0073C259
KillTimer.USER32(?,00000001,?,?), ref: 0073C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0073C270

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: e17e78e404f8884ca87721b4b822b9a4bd42d783ed2ff902ff088a3e8a995ec5
Instruction ID: 2d3a69e6fbb343260bbdb5a6c42e552cdcad933bfd16d72c359573a18a8d570c
Opcode Fuzzy Hash: e17e78e404f8884ca87721b4b822b9a4bd42d783ed2ff902ff088a3e8a995ec5
Instruction Fuzzy Hash: A831C3B0904354AFFB739F648855BE7BBECAB06304F00449ED2DAA7242C7785A84CB55

Function 007086AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,007085CC,?,00798CC8,0000000C), ref: 00708704
GetLastError.KERNEL32(?,007085CC,?,00798CC8,0000000C), ref: 0070870E
__dosmaperr.LIBCMT ref: 00708739

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction ID: 692483a3ab54d14df2aed2cacb12682a3488c419d939deebaf568e5245d38394
Opcode Fuzzy Hash: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction Fuzzy Hash: 6E018232604220D6C6A06374984977F6BC54B92778F3A0319F8449B1D3DEAECC818696

Function 006DDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 006DDB7B
DispatchMessageW.USER32(?), ref: 006DDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006DDB9F
Sleep.KERNELBASE(0000000A), ref: 006DDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00721CC9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 282082dcb78b3febb0da3e76299e30f34f9d04663ef6d4ab30416c1c8bc9c933
Instruction ID: e8f998d3435fdae2a977c689e175954f9cd3aef6a04c5afed0323581852eeffe
Opcode Fuzzy Hash: 282082dcb78b3febb0da3e76299e30f34f9d04663ef6d4ab30416c1c8bc9c933
Instruction Fuzzy Hash: 13F082306453809BE730DB60DC49FEA73ADEF85310F508A1AE65AC31C0DB789488DB29

Function 006E1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006E17F6

Strings

CALL, xrefs: 006E17C6

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 470c14ec326caca8eccc378cebefe56d72bbdd62e4bebc2f587213cea15ce41c
Instruction ID: f6da508861ad4953d508e1535e926df3e83e9875443ea41a12b65b0f5a42479b
Opcode Fuzzy Hash: 470c14ec326caca8eccc378cebefe56d72bbdd62e4bebc2f587213cea15ce41c
Instruction Fuzzy Hash: AE22BEB0609381DFC714DF15C480A2ABBF2BF86314F24895EF4968B3A2D735E955DB82

Function 006D3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: adb28ec2223352f5104074ac1a07ba821361ee7aaaf62b0607d5f67549f1b09c
Instruction ID: 79c42ccf176c1bb4e22486b7fba26b862c6b782aefb7d067f0c048c44b7b10dd
Opcode Fuzzy Hash: adb28ec2223352f5104074ac1a07ba821361ee7aaaf62b0607d5f67549f1b09c
Instruction Fuzzy Hash: 29317F709043119FE761DF24D885797BBE8FB49708F00092EF59A97380E7B5AA44CB56

Function 006EF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 006EF661

Part of subcall function 006DD730: GetInputState.USER32 ref: 006DD807

Sleep.KERNEL32(00000000), ref: 0072F2DE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 75fb255c2cf79d7e2e473b16548619395de6a1943665b82fddbb61c2dd9c7255
Instruction ID: 251f2ca6329240571e384c68ff2fea94bb4bd85356c98ba98208208b2866068b
Opcode Fuzzy Hash: 75fb255c2cf79d7e2e473b16548619395de6a1943665b82fddbb61c2dd9c7255
Instruction Fuzzy Hash: 45F08C312403059FD354EF69E449B6AB7E9FF46760F00402AE85AC7360DBB0A800CB98

Function 00762598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00762649

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: a68fed054c8eac3fe6ec9f8953ddebc01132565374eb4a070aacbaa1a0998a09
Instruction ID: 56e375f958161623bf29230c71b553eb46eab268b5956ee1d37161b0791ed204
Opcode Fuzzy Hash: a68fed054c8eac3fe6ec9f8953ddebc01132565374eb4a070aacbaa1a0998a09
Instruction Fuzzy Hash: F721B374200A16AFD7A0DF14C890D76B799EF44368B14805DEC978B793C775ED46CB90

Function 007613B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00761420

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 9dd7fb068b259fe63075b04e92e795c86e7ea7982f6ed3eb8f44c4480285ca30
Instruction ID: dc54cc1700a6c354cef65283ebb3165bb53e9f829cf35a8830a0c24e8386d978
Opcode Fuzzy Hash: 9dd7fb068b259fe63075b04e92e795c86e7ea7982f6ed3eb8f44c4480285ca30
Instruction Fuzzy Hash: 3431A230604642AFD754DF25C499B69BBA2FF44324F448169E8568B392DF79FC41CBD0

Function 006D4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
Part of subcall function 006D4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
Part of subcall function 006D4E90: FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EFD

Part of subcall function 006D4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
Part of subcall function 006D4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
Part of subcall function 006D4E59: FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: f4ffc94e329e448220627c2465c3127b93e3f59d35b4c151ebc9923c4491e3c1
Instruction ID: 3769fc95d8d3bfc9fa5135d166221eefd0471c2d829a7552919076a1cec7f099
Opcode Fuzzy Hash: f4ffc94e329e448220627c2465c3127b93e3f59d35b4c151ebc9923c4491e3c1
Instruction Fuzzy Hash: C511E332A10205ABCB14AF64DC06FAD77A6AF80710F10842FF542A62E1EE759E4597A8

Function 00708402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00708440

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction ID: 9e74547d622ed3aa9fcfc4ab4b14abffb69a5afdee45ef2d717e5a564d98165f
Opcode Fuzzy Hash: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction Fuzzy Hash: A911487190410AEFCB05DF58E9459DE7BF4EF48300F104159F808AB352DA30EA11CBA5

Function 00705000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00704C7D: RtlAllocateHeap.NTDLL(00000008,006D1129,00000000,?,00702E29,00000001,00000364,?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?), ref: 00704CBE

_free.LIBCMT ref: 0070506C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 11cf934ffb77c74cd605304aa006e28a374b8a00ecd16baae9fbab7f5e5de82b
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 13012672204704EBE3218E65D885A5BFBECFB89370F250B1DE184972C0EA34A805CAB4

Function 007629BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,007614B5,?), ref: 00762A01

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: e26fec78af9b33939301f7560200b034babb10a83a774cb30dd0e4f6e2611891
Instruction ID: d5815f7febaa4c44dcd80f35980bfb0d9c4b88c23d178832780b2dda505a5404
Opcode Fuzzy Hash: e26fec78af9b33939301f7560200b034babb10a83a774cb30dd0e4f6e2611891
Instruction Fuzzy Hash: 80019236304E419FD3A58A6CC454B223792EBC5318F2DC468C8479B252DB7AFC43C790

Function 006FE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 01e240f1e917896abc80fe4516ec04b53bd0c628eb0e8dd1ba13734fee0edde0
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 52F0F932510A1CD6C6313E698C09BBA37DA9F52335F100719F721D62E2DF75A40286AA

Function 0076149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 007614EB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 302c0bc14756d479a458f0f8c7754abb9dee231adfb31a20cdec7f26ca30edfc
Instruction ID: 35b06b8f8ed19655d9b8a32acc24444ecb8bfed084f56da80bc7d151ce59c289
Opcode Fuzzy Hash: 302c0bc14756d479a458f0f8c7754abb9dee231adfb31a20cdec7f26ca30edfc
Instruction Fuzzy Hash: E901B1352047819FD320CF69C444826BB95EF84364798C059EC4B8B712DA76DD82C780

Function 00704C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,006D1129,00000000,?,00702E29,00000001,00000364,?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?), ref: 00704CBE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a1da503a197f9b7ce5f53b2590544daa5a8d2e2f6e172effb38e5e2b0a3a7dc
Instruction ID: 3199269f572017f9a9c47764da8140db7e3c88412d754547f9726722210c50b0
Opcode Fuzzy Hash: 2a1da503a197f9b7ce5f53b2590544daa5a8d2e2f6e172effb38e5e2b0a3a7dc
Instruction Fuzzy Hash: 43F0B471602228E7FB215F629C09B6B37C9AF817A0F148315FA1AA61C1CA78DC0046F4

Function 00703820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07224ee06ba8bbdae8e40ca07ef8ee1516b08c0374c19c0fcf1cdc2d67d875c3
Instruction ID: 09fa9a2ec818a8685a1700816b2f390152e1071dd1a73c792986c850c77d881d
Opcode Fuzzy Hash: 07224ee06ba8bbdae8e40ca07ef8ee1516b08c0374c19c0fcf1cdc2d67d875c3
Instruction Fuzzy Hash: EEE0E531101228DAE7212A669C01BAB37CEAF827B0F0582A5FD05928C0CB59DE0182F4

Function 006D4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4F6D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4365880593ad6d998c2b084569d1d99ab49d64b39612875fb40c24dbf75d897b
Instruction ID: b1c3d25e88725391489fe39014f31fdd2428bd8c71544a5fa44e7e858eb0eb40
Opcode Fuzzy Hash: 4365880593ad6d998c2b084569d1d99ab49d64b39612875fb40c24dbf75d897b
Instruction Fuzzy Hash: 79F01571905752CFDB389F64D490862BBE6AF54329320C96FE2EA82721CB329C44DB50

Function 00762A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00762A66

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: d406062c5a18d6a09720eb5f47c265cb6d9ecc59faa4a99bc1d25b9989ac3c42
Instruction ID: 8580720e34c304fe13fe5fe9ed5c9d18f60ed3b2ae0f6f270a18e51de817be48
Opcode Fuzzy Hash: d406062c5a18d6a09720eb5f47c265cb6d9ecc59faa4a99bc1d25b9989ac3c42
Instruction Fuzzy Hash: CEE0DF36350516EAD754EA70DC848FA734CEB10395B108536EC2BC2102DB7C9D9286A0

Function 006D2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction ID: 96d139bb0ee0fadfac485d8c487a3b054639c80b056c9e4d9a34d1f3b425df6e
Opcode Fuzzy Hash: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction Fuzzy Hash: 48E0CD72A042245BC711A258DC05FEA77EDDFC8790F044076FD09D7248D964AD808554

Function 006D2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006D3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Part of subcall function 006DD730: GetInputState.USER32 ref: 006DD807

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 006D314E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 8e08083ccb4785e4b37018182a35aefbb346bb1311863634109e1ca0bef28834
Instruction ID: edef477a271c63e4342d898df42b961692f0689ed6ecfbeef44e16163f68a6d8
Opcode Fuzzy Hash: 8e08083ccb4785e4b37018182a35aefbb346bb1311863634109e1ca0bef28834
Instruction Fuzzy Hash: 5DE08621F0425406CA48BB75A8525BDB75B9BD6355F40553FF14283362CE684945426B

Function 00733D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00733D18

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: d61faebed3cc84d3c12c9a15429c7813d18c80586333f7ce31968af65c29897e
Instruction ID: 3ba96f6dc73979dd900352289fe7d563f87b78fc9eb91aba1a785eaf681e81eb
Opcode Fuzzy Hash: d61faebed3cc84d3c12c9a15429c7813d18c80586333f7ce31968af65c29897e
Instruction Fuzzy Hash: 0FD012E06A03087EFB0093718C0BEBB329CC316A81F008BA4BA03D64C1D9A4DE080134

Function 0071039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction ID: d477e03677c6218b0e6dc21e58d2b071fe16924a180e92311d64b03e088f60c5
Opcode Fuzzy Hash: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction Fuzzy Hash: 57D06C3204020DBBDF028F84DD06EDA3BAAFB48714F018000FE5856020C776E821AB94

Function 006D1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 006D1CBC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 23e464ea5a9d661a48ab30560df067c658f9e8b9fc96428defa99192b8fb3478
Instruction ID: 437d8e80dc457f589fb94835ac0b8ea9e3086a13963fd3a3fd871fd89376ef4c
Opcode Fuzzy Hash: 23e464ea5a9d661a48ab30560df067c658f9e8b9fc96428defa99192b8fb3478
Instruction Fuzzy Hash: DFC09B352803049FF6154B84BC5AF107754B389B10F54C001F64A555E3C3E51430DA58

Non-executed Functions

Function 00769576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0076961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0076965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0076969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007696C9
SendMessageW.USER32 ref: 007696F2
GetKeyState.USER32(00000011), ref: 0076978B
GetKeyState.USER32(00000009), ref: 00769798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007697AE
GetKeyState.USER32(00000010), ref: 007697B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007697E9
SendMessageW.USER32 ref: 00769810
SendMessageW.USER32(?,00001030,?,00767E95), ref: 00769918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0076992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00769941
SetCapture.USER32(?), ref: 0076994A
ClientToScreen.USER32(?,?), ref: 007699AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007699BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007699D6
ReleaseCapture.USER32 ref: 007699E1
GetCursorPos.USER32(?), ref: 00769A19
ScreenToClient.USER32(?,?), ref: 00769A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00769A80
SendMessageW.USER32 ref: 00769AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00769AEB
SendMessageW.USER32 ref: 00769B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00769B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00769B4A
GetCursorPos.USER32(?), ref: 00769B68
ScreenToClient.USER32(?,?), ref: 00769B75
GetParent.USER32(?), ref: 00769B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00769BFA
SendMessageW.USER32 ref: 00769C2B
ClientToScreen.USER32(?,?), ref: 00769C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00769CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00769CDE
SendMessageW.USER32 ref: 00769D01
ClientToScreen.USER32(?,?), ref: 00769D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00769D82

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

GetWindowLongW.USER32(?,000000F0), ref: 00769E05

Strings

@GUI_DRAGID, xrefs: 0076997D
p#z, xrefs: 00769990
F, xrefs: 00769D07

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#z
API String ID: 3429851547-1540955567
Opcode ID: e8027b4b60ec734027a5cac4b19118d96f840ad285ff4194ee94c370c636445e
Instruction ID: 7a275131c28007e500befe792f2272de77986f046660e3848057fefe466901d2
Opcode Fuzzy Hash: e8027b4b60ec734027a5cac4b19118d96f840ad285ff4194ee94c370c636445e
Instruction Fuzzy Hash: 44429C34204341EFDB25CF28CC44AAABBE9FF89310F14465DFA9A872A1D779E850CB55

Function 00764873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 007648F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00764908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00764927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0076494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0076495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0076497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 007649AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 007649D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00764A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00764A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00764A7E
IsMenu.USER32(?), ref: 00764A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00764AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00764B20
GetWindowLongW.USER32(?,000000F0), ref: 00764B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00764BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00764C82
wsprintfW.USER32 ref: 00764CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00764CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00764CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00764D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00764D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00764D5A

Strings

%d/%02d/%02d, xrefs: 00764CA8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 7bcc6cc579010c70234cc6b17be5d88bf22366fd62b9a6fb65fa99434250b9ff
Instruction ID: ad4ffb4d250d748a69cbfe89c402f1c4327c732937e39f5e5be5d4a7b59b8de7
Opcode Fuzzy Hash: 7bcc6cc579010c70234cc6b17be5d88bf22366fd62b9a6fb65fa99434250b9ff
Instruction Fuzzy Hash: CB12FD71600345ABEB258F24DC49FBE7BF8EF45310F148169F916EB2A1DBB89940CB54

Function 00731201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 007316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
Part of subcall function 007316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
Part of subcall function 007316C3: GetLastError.KERNEL32 ref: 0073174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00731286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 007312A8
CloseHandle.KERNEL32(?), ref: 007312B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007312D1
GetProcessWindowStation.USER32 ref: 007312EA
SetProcessWindowStation.USER32(00000000), ref: 007312F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00731310

Part of subcall function 007310BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007311FC), ref: 007310D4
Part of subcall function 007310BF: CloseHandle.KERNEL32(?,?,007311FC), ref: 007310E9

Strings

, xrefs: 0073125A
default, xrefs: 0073130B
Zy, xrefs: 00731392
winsta0, xrefs: 007312CC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Zy
API String ID: 22674027-3658735108
Opcode ID: a3166f52331c5363fec231b6a37a789a5ff1c9bc2f17d7e38b983d6cdaebe2e8
Instruction ID: 2286707e369433f30c1929e76b8c96cb9e6e2cba471c3f6a0c462a38e4463468
Opcode Fuzzy Hash: a3166f52331c5363fec231b6a37a789a5ff1c9bc2f17d7e38b983d6cdaebe2e8
Instruction Fuzzy Hash: AB81AC71900349AFEF219FA4DC49FFE7BB9EF04700F188129F911A61A2CB798944CB65

Function 00730B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
Part of subcall function 007310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
Part of subcall function 007310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
Part of subcall function 007310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00730BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00730C00
GetLengthSid.ADVAPI32(?), ref: 00730C17
GetAce.ADVAPI32(?,00000000,?), ref: 00730C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00730C6D
GetLengthSid.ADVAPI32(?), ref: 00730C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00730C8C
HeapAlloc.KERNEL32(00000000), ref: 00730C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00730CB4
CopySid.ADVAPI32(00000000), ref: 00730CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00730CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00730D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00730D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D45
HeapFree.KERNEL32(00000000), ref: 00730D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D55
HeapFree.KERNEL32(00000000), ref: 00730D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D65
HeapFree.KERNEL32(00000000), ref: 00730D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00730D78
HeapFree.KERNEL32(00000000), ref: 00730D7F

Part of subcall function 00731193: GetProcessHeap.KERNEL32(00000008,00730BB1,?,00000000,?,00730BB1,?), ref: 007311A1
Part of subcall function 00731193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00730BB1,?), ref: 007311A8
Part of subcall function 00731193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00730BB1,?), ref: 007311B7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: d0da6c846c2da9ede811e80dd3f2df1d32031d6f1a5231efb55b3de6e90706bc
Instruction ID: 2e4cc43748dea0ee93f3fc4515fb786a8a89af4e5da4d4779ff994940bc917d0
Opcode Fuzzy Hash: d0da6c846c2da9ede811e80dd3f2df1d32031d6f1a5231efb55b3de6e90706bc
Instruction Fuzzy Hash: 13717D72A0020AABEF11DFA4DC45FEEBBB8BF04300F048555E955A7192D7B9A905CBB0

Function 0074EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0076CC08), ref: 0074EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0074EB37
GetClipboardData.USER32(0000000D), ref: 0074EB43
CloseClipboard.USER32 ref: 0074EB4F
GlobalLock.KERNEL32(00000000), ref: 0074EB87
CloseClipboard.USER32 ref: 0074EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0074EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0074EBC9
GetClipboardData.USER32(00000001), ref: 0074EBD1
GlobalLock.KERNEL32(00000000), ref: 0074EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0074EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0074EC38
GetClipboardData.USER32(0000000F), ref: 0074EC44
GlobalLock.KERNEL32(00000000), ref: 0074EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0074EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0074EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0074ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0074ECF3
CountClipboardFormats.USER32 ref: 0074ED14
CloseClipboard.USER32 ref: 0074ED59

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: f9ad4836b8881398c805ec99b10c4ec892ae9ad04fb1793d89e9b3b448b4446d
Instruction ID: 26bca0bc1d2f79236c8b5b7e59c8c7fe617b200fc349f9ecedf46cbd8b36394c
Opcode Fuzzy Hash: f9ad4836b8881398c805ec99b10c4ec892ae9ad04fb1793d89e9b3b448b4446d
Instruction Fuzzy Hash: E661AC742043019FD301EF24D898F3A77A5FF84724F08855EF896872A2CB79E905CBA6

Function 0074698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007469BE
FindClose.KERNEL32(00000000), ref: 00746A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00746A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00746A75

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00746AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00746ADF

Strings

%02d, xrefs: 00746C00, 00746C0A, 00746C5A, 00746CAA, 00746CFA, 00746D4A
%03d, xrefs: 00746DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00746B32
%4d%02d%02d%02d%02d%02d, xrefs: 00746B6A
%4d, xrefs: 00746BB1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: ce5ab46fd1609299e68eb528a3760ec7fe76e7fba490e43b7a37ed0cebaf3dc8
Instruction ID: fe9c467129c160baf71d1a7cbb9fe03151f040d5701f3ae4040243f957447cb9
Opcode Fuzzy Hash: ce5ab46fd1609299e68eb528a3760ec7fe76e7fba490e43b7a37ed0cebaf3dc8
Instruction Fuzzy Hash: 42D173B1908340AFC754EBA4D891EABB7EDBF88704F44491EF585C7291EB74DA04CB62

Function 00749642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00749663
GetFileAttributesW.KERNEL32(?), ref: 007496A1
SetFileAttributesW.KERNEL32(?,?), ref: 007496BB
FindNextFileW.KERNEL32(00000000,?), ref: 007496D3
FindClose.KERNEL32(00000000), ref: 007496DE
FindFirstFileW.KERNEL32(*.*,?), ref: 007496FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0074974A
SetCurrentDirectoryW.KERNEL32(00796B7C), ref: 00749768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00749772
FindClose.KERNEL32(00000000), ref: 0074977F
FindClose.KERNEL32(00000000), ref: 0074978F

Strings

*.*, xrefs: 007496F5

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 6a189900d562fd0f3cfdd0de180322517b7f1be12165ae9442f54888fe8bf475
Instruction ID: 9dd12a5f6265c9a0a3a34b12d2d3c94abe420f8161b55ac953df22588976fcbd
Opcode Fuzzy Hash: 6a189900d562fd0f3cfdd0de180322517b7f1be12165ae9442f54888fe8bf475
Instruction Fuzzy Hash: B731F9725402196EDF11EFB4DC09AEF77ACAF09320F148156FA56E2190EB78DE448B14

Function 0074979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007497BE
FindNextFileW.KERNEL32(00000000,?), ref: 00749819
FindClose.KERNEL32(00000000), ref: 00749824
FindFirstFileW.KERNEL32(*.*,?), ref: 00749840
SetCurrentDirectoryW.KERNEL32(?), ref: 00749890
SetCurrentDirectoryW.KERNEL32(00796B7C), ref: 007498AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007498B8
FindClose.KERNEL32(00000000), ref: 007498C5
FindClose.KERNEL32(00000000), ref: 007498D5

Part of subcall function 0073DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0073DB00

Strings

*.*, xrefs: 0074983B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c780874a21ad45ac86f7947febb4d53a835f8b8b8cef2efe8260e8610610cd08
Instruction ID: c049285ddb61d30c35fcd9dfff684781a7d875f4b443f07a49a77d302ff12b77
Opcode Fuzzy Hash: c780874a21ad45ac86f7947febb4d53a835f8b8b8cef2efe8260e8610610cd08
Instruction Fuzzy Hash: C931E4715003196EEF11EFB8EC49AEF77ACAF06320F148256FA51A2191DB78DE44CB24

Function 0075BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0075BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0075BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0075C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0075C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0075C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0075C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0075C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0075C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0075C382
RegCloseKey.ADVAPI32(00000000), ref: 0075C38F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: c84db8bbf9537da26a56b11c644798822af74de0af8dfb5351454e99f2becab6
Instruction ID: d72867ddc808613731471449622b75673e9b3e774329c3de5ec4e7ad4cf207a7
Opcode Fuzzy Hash: c84db8bbf9537da26a56b11c644798822af74de0af8dfb5351454e99f2becab6
Instruction Fuzzy Hash: 0D025B70604300AFD715CF28C895E6ABBE5AF89304F18C49DF84ACB2A2DB75ED45CB52

Function 00748195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00748257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00748267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00748273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00748310
SetCurrentDirectoryW.KERNEL32(?), ref: 00748324
SetCurrentDirectoryW.KERNEL32(?), ref: 00748356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0074838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00748395

Strings

*.*, xrefs: 0074839B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 0c3c1c8d972425a22753478f90c2e5629657babe5ecc5d1133feb463515690b3
Instruction ID: b7adcd07df4f8150e2f4655e967cec24d17107c75c5b6f2a12519b71cc609257
Opcode Fuzzy Hash: 0c3c1c8d972425a22753478f90c2e5629657babe5ecc5d1133feb463515690b3
Instruction Fuzzy Hash: 5A616A725043099FCB50EF64D8449AEB3E9FF89310F04891EF989C7251EB39E945CB96

Function 0073D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

FindFirstFileW.KERNEL32(?,?), ref: 0073D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0073D1DD
MoveFileW.KERNEL32(?,?), ref: 0073D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0073D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0073D237

Part of subcall function 0073D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0073D21C,?,?), ref: 0073D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0073D253
FindClose.KERNEL32(00000000), ref: 0073D264

Strings

\*.*, xrefs: 0073D0CD, 0073D0D6, 0073D0EB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 8d8350918ee7d2835e02ad51641f89498d10bb290706d340d4796fa6929d2817
Instruction ID: bce085d378b6d754e39ed4505b7288ef27929317601873dc31b4c67e6b6eb938
Opcode Fuzzy Hash: 8d8350918ee7d2835e02ad51641f89498d10bb290706d340d4796fa6929d2817
Instruction Fuzzy Hash: 75618D31D0110D9FDF15EBE0EA929EEB776AF15300F24416AE40277292EB345F09DB65

Function 0074ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0074ED91
EmptyClipboard.USER32 ref: 0074ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0074EDAC
CloseClipboard.USER32 ref: 0074EEA3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d7bc9851155d743fe890564f93417b07b91641f4f64ea739b960c5818ef115ae
Instruction ID: 76fd42fe24232da41f34ba76e19fb0f16b4ea39360d2add1a9b01192d92906c7
Opcode Fuzzy Hash: d7bc9851155d743fe890564f93417b07b91641f4f64ea739b960c5818ef115ae
Instruction Fuzzy Hash: 1C417935604611AFE721DF15D888F2ABBA5FF44328F14C099E8568B662C779EC42CB98

Function 0073E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
Part of subcall function 007316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
Part of subcall function 007316C3: GetLastError.KERNEL32 ref: 0073174A

ExitWindowsEx.USER32(?,00000000), ref: 0073E932

Strings

, xrefs: 0073E920
SeShutdownPrivilege, xrefs: 0073E902
@, xrefs: 0073E925
, xrefs: 0073E95C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 29605785c4c4f674a4c988537f27825083788cba4fe7177f13e150eb66884608
Instruction ID: 7644832773076d6076f8b54017c6d6cdc5ef9e16c7ca41c84611a131e81c1e17
Opcode Fuzzy Hash: 29605785c4c4f674a4c988537f27825083788cba4fe7177f13e150eb66884608
Instruction Fuzzy Hash: 4B01D672610315EBFB5466B49C8ABBB725CA714750F154522FC03E21D3D5AD6C408395

Function 00751204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00751276
WSAGetLastError.WSOCK32 ref: 00751283
bind.WSOCK32(00000000,?,00000010), ref: 007512BA
WSAGetLastError.WSOCK32 ref: 007512C5
closesocket.WSOCK32(00000000), ref: 007512F4
listen.WSOCK32(00000000,00000005), ref: 00751303
WSAGetLastError.WSOCK32 ref: 0075130D
closesocket.WSOCK32(00000000), ref: 0075133C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: e11f8cacd6958e878d31d180a7fc7d56a5fac0d13bd429cabf37b67a729695c9
Instruction ID: 4a023fd7b94370d9522c3e88ee3e41cf9f48f41cd75a973526b27d2c490e090f
Opcode Fuzzy Hash: e11f8cacd6958e878d31d180a7fc7d56a5fac0d13bd429cabf37b67a729695c9
Instruction Fuzzy Hash: B6419331A002019FD710DF24C498B69BBE6BF86319F588199D8568F396C7B9EC85CBE1

Function 0073D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

FindFirstFileW.KERNEL32(?,?), ref: 0073D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0073D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0073D481
FindClose.KERNEL32(00000000), ref: 0073D498
FindClose.KERNEL32(00000000), ref: 0073D4A1

Strings

\*.*, xrefs: 0073D3F2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: d0d186c2cc7bbfd8b449b01c630ffdaa9258bd91fc18ec41823ea8d55f5985ad
Instruction ID: eac0b61cea7083ceae01ddbda10383e577232688b13f8a8e79fb91f9164828a7
Opcode Fuzzy Hash: d0d186c2cc7bbfd8b449b01c630ffdaa9258bd91fc18ec41823ea8d55f5985ad
Instruction Fuzzy Hash: 793190314083819FD315EF60D8918AFB7A9BE91300F444A1EF8D152292EB34AE09C7A7

Function 0070E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0070E645

Strings

1#SNAN, xrefs: 0070F844
1#INF, xrefs: 0070F852
1#QNAN, xrefs: 0070F84B
1#IND, xrefs: 0070F83D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4e7c5b1c64c152118a28c5fc1936f06ccb31f59c6b77d74653aaee0572b1885b
Instruction ID: fc4c059e3dd3992df76e8b32b6770aea6016ab072556c73e08d9e955c1b7d637
Opcode Fuzzy Hash: 4e7c5b1c64c152118a28c5fc1936f06ccb31f59c6b77d74653aaee0572b1885b
Instruction Fuzzy Hash: C1C22971E04628CFDB65CE289D407EAB7F5EB44314F1446EAD84DE7281E778AE818F40

Function 0074648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 007464DC
CoInitialize.OLE32(00000000), ref: 00746639
CoCreateInstance.OLE32(0076FCF8,00000000,00000001,0076FB68,?), ref: 00746650
CoUninitialize.OLE32 ref: 007468D4

Strings

.lnk, xrefs: 007464BA, 00746524, 007465E0

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 23728add326f4e8799e038a8273b90ec5e76e3cf346854aa68f885b76ec5ca21
Instruction ID: cb9ef2f34f99fcac94052ca47b1de849c821af0f6a8f52df6ca59be83f865122
Opcode Fuzzy Hash: 23728add326f4e8799e038a8273b90ec5e76e3cf346854aa68f885b76ec5ca21
Instruction Fuzzy Hash: 80D12871908301AFC354EF24C88196BB7E9FF95704F40496DF5958B2A1EB71ED05CBA2

Function 007522DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 007522E8

Part of subcall function 0074E4EC: GetWindowRect.USER32(?,?), ref: 0074E504

GetDesktopWindow.USER32 ref: 00752312
GetWindowRect.USER32(00000000), ref: 00752319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00752355
GetCursorPos.USER32(?), ref: 00752381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007523DF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: d54fffd5f024aabe2b2580e9e6235095c6319d0da017b0ff68374bb4ac410211
Instruction ID: ada55b00d8781adb8c5756bfe7e74830e864a914e828ce3784f89565fd000adf
Opcode Fuzzy Hash: d54fffd5f024aabe2b2580e9e6235095c6319d0da017b0ff68374bb4ac410211
Instruction Fuzzy Hash: 1F310072104345AFD720DF54CC48BABBBA9FF85310F000919F98697182DBB8EA09CB96

Function 00749B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00749B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00749C8B

Part of subcall function 00743874: GetInputState.USER32 ref: 007438CB
Part of subcall function 00743874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00743966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00749BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00749C75

Strings

*.*, xrefs: 00749B5D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 8dd11add7149dc5ab0d17a56fc657661ed4d19806dc38841bde0c914caba73a3
Instruction ID: 182ebe23035464f94f5a1a4284ce08357c866eb50e0760f73a40d2cca932f5be
Opcode Fuzzy Hash: 8dd11add7149dc5ab0d17a56fc657661ed4d19806dc38841bde0c914caba73a3
Instruction Fuzzy Hash: 6C419071D0020A9FCF55DFB4C989AEEBBB9EF05300F24415AE905A2291EB349E84CF64

Function 006E997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 006E9A4E
GetSysColor.USER32(0000000F), ref: 006E9B23
SetBkColor.GDI32(?,00000000), ref: 006E9B36

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 71d67bfb49a92f646ffba73c8a7da5ac1453249e6257f14826549e441ab62c2c
Instruction ID: 28c86317299bfd33e0a8eb43354ab93956642fb2f3a4ce3490b17ac741a9cfeb
Opcode Fuzzy Hash: 71d67bfb49a92f646ffba73c8a7da5ac1453249e6257f14826549e441ab62c2c
Instruction Fuzzy Hash: 08A1397010A7A0FEE72D9A2E9D59DBB365FDF82304F144229F902C6791CA2D9D02C676

Function 00751806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
Part of subcall function 0075304E: _wcslen.LIBCMT ref: 0075309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0075185D
WSAGetLastError.WSOCK32 ref: 00751884
bind.WSOCK32(00000000,?,00000010), ref: 007518DB
WSAGetLastError.WSOCK32 ref: 007518E6
closesocket.WSOCK32(00000000), ref: 00751915

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 9a6f4fb0ee30d4bc216c5916cd5c2d1326cffc5da6c57927f665e5180eaf2df7
Instruction ID: c407075c5f2950f4b479861e2bb77e6603acefab2388f9c2327bb913dbe9ed29
Opcode Fuzzy Hash: 9a6f4fb0ee30d4bc216c5916cd5c2d1326cffc5da6c57927f665e5180eaf2df7
Instruction Fuzzy Hash: 5551D471A002009FE720AF24C886F6A77E69B44718F54805DF9469F3C3C7B5AD41CBE5

Function 00761C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00761CC0
IsWindowEnabled.USER32 ref: 00761CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00761CDB
IsIconic.USER32 ref: 00761CE9
IsZoomed.USER32 ref: 00761CF7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b9d00228593e939983770f5399381308accc4a0a5fa6062eb055e899ba1e3e00
Instruction ID: 57dad3b70f95f710f34e9ebd65a39afcc3aa1d7c0278e67fac60c56f80b37cf1
Opcode Fuzzy Hash: b9d00228593e939983770f5399381308accc4a0a5fa6062eb055e899ba1e3e00
Instruction Fuzzy Hash: 7A21B1317406019FD7218F2AC848B6A7BA5EF95324B9D8059EC47CB352CBB9DC42CBA4

Function 006D8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 006D843C
ERCP, xrefs: 006D813C
VUUU, xrefs: 00715DF0
VUUU, xrefs: 006D83E8
VUUU, xrefs: 006D83FA

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: ba38798e410491dae5b845a6c3c9afdf7cdbd403ea7af68e1c94db77ac390410
Instruction ID: efcc6938f8e35a1f35dbea4f23efc3e309a218667f0b2e7dc190ecb63132d0b8
Opcode Fuzzy Hash: ba38798e410491dae5b845a6c3c9afdf7cdbd403ea7af68e1c94db77ac390410
Instruction Fuzzy Hash: 1CA23C71E0061ACFDF24CF58C8447EDB7B2BB54314F2481AAE855A7385EB789D81CB90

Function 00738298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007382AA

Strings

|, xrefs: 007382DA
(, xrefs: 007382F0
tby, xrefs: 007384F4

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tby$|
API String ID: 1659193697-2466584908
Opcode ID: b4675c18560e665b846b28d57759fda626cd298fa6d11fbef24218c9c696d1d5
Instruction ID: ba284e5c921038b52b2eb15278b4e4f79bf28b77b3e0acc91572e785a4e4fe4e
Opcode Fuzzy Hash: b4675c18560e665b846b28d57759fda626cd298fa6d11fbef24218c9c696d1d5
Instruction Fuzzy Hash: B2323574A00705DFDB68CF59C081A6AB7F1FF48710B15856EE49ADB3A2EB74E941CB40

Function 0075A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0075A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0075A6BA

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0075A79C
CloseHandle.KERNEL32(00000000), ref: 0075A7AB

Part of subcall function 006ECE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00713303,?), ref: 006ECE8A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: eb121874e7872a5127574d86965a1bfd0f1f658c39bcf21a7702f4fa5e5a5c72
Instruction ID: 7846b0c523e5dbecaee7f45f4c12ba40fca8bb249599fd89b8535eaecb573475
Opcode Fuzzy Hash: eb121874e7872a5127574d86965a1bfd0f1f658c39bcf21a7702f4fa5e5a5c72
Instruction Fuzzy Hash: 28518F71908300AFD750DF24C885A6BBBE9FF89754F00892EF98597351EB74D904CB96

Function 0073AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0073AAAC
SetKeyboardState.USER32(00000080), ref: 0073AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0073AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0073AB88

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4bd650200eb1c085d6d9ef9c9f27ca8063e517b6d0ee1f2c7e1094429be5ee9a
Instruction ID: 129404737919c7410d2705fcaff36fe9de98f035896fdfe152072b2e7bf3ceb6
Opcode Fuzzy Hash: 4bd650200eb1c085d6d9ef9c9f27ca8063e517b6d0ee1f2c7e1094429be5ee9a
Instruction Fuzzy Hash: E131E7B1A40248BEFF35CB65CC06BFABBAAAB44310F04821AE5C1565D2D37D8981C767

Function 0070BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0070BB7F

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

GetTimeZoneInformation.KERNEL32 ref: 0070BB91
WideCharToMultiByte.KERNEL32(00000000,?,007A121C,000000FF,?,0000003F,?,?), ref: 0070BC09
WideCharToMultiByte.KERNEL32(00000000,?,007A1270,000000FF,?,0000003F,?,?,?,007A121C,000000FF,?,0000003F,?,?), ref: 0070BC36

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 048904fbbed21a00ba203c45d5b6c8a7cde1706b4dd59f2a73848c5a6be146e3
Instruction ID: f4dee65b387e239343ce31ead7a947d8434dbfa77be6552dea6929e4223d5dc4
Opcode Fuzzy Hash: 048904fbbed21a00ba203c45d5b6c8a7cde1706b4dd59f2a73848c5a6be146e3
Instruction Fuzzy Hash: 5F31BE70A04245DFEB11DF69CC80A6ABBF8FF86350B14836AE061D72E1D7789E40CB64

Function 0074CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0074CE89
GetLastError.KERNEL32(?,00000000), ref: 0074CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0074CEFE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: a44bc3c56daf11f0f4218ea46fca923a4d556168da422d1e3ba6f288b48b2b99
Instruction ID: 5e83847490e8a6298e77c76b65a89ae602836447611fa2be20e10eb850a88be2
Opcode Fuzzy Hash: a44bc3c56daf11f0f4218ea46fca923a4d556168da422d1e3ba6f288b48b2b99
Instruction Fuzzy Hash: 8021CFB2501305DFEB62DFA5C948BA77BFCEB00314F10842EE646D2151E778EE088B54

Function 00745C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00745CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00745D17
FindClose.KERNEL32(?), ref: 00745D5F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: eb5b523df8ad076e4f6c777a06aae00a24723d2d08585e089488d7d9f5693cbd
Instruction ID: a565a0a961876adbc12d59d87389946b627acb421cecd4df7ad2889286429179
Opcode Fuzzy Hash: eb5b523df8ad076e4f6c777a06aae00a24723d2d08585e089488d7d9f5693cbd
Instruction Fuzzy Hash: EA516874A04A019FC714DF28C494A9AB7E5FF49324F14855EE99A8B3A2DB34ED04CF91

Function 00702622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0070271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00702724
UnhandledExceptionFilter.KERNEL32(?), ref: 00702731

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 10c37ab6fa80ee9a3f2465fad78fcb503204293edf5eb32fb2fad4c58867823e
Instruction ID: 6de7ad7c03e04120af60d7a20141a5c827c0e0574be8d558ef923d8ef415efe7
Opcode Fuzzy Hash: 10c37ab6fa80ee9a3f2465fad78fcb503204293edf5eb32fb2fad4c58867823e
Instruction Fuzzy Hash: 9631C47591121C9BCB61DF68DC88798BBB8BF08310F5042EAE90CA6261E7749F818F49

Function 007451CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007451DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00745238
SetErrorMode.KERNEL32(00000000), ref: 007452A1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1368a1a95e7841840ae6ee3b64f494694afe8f662db0178cf1cb354328d4a80a
Instruction ID: cb428331a942e173e58d8081716f406feec75a5c1e3b666248eb3a6dbb6df7db
Opcode Fuzzy Hash: 1368a1a95e7841840ae6ee3b64f494694afe8f662db0178cf1cb354328d4a80a
Instruction Fuzzy Hash: F3318F75A00608DFDB00DF94D884EADBBB5FF49314F08809AE805AB362DB75EC46CB91

Function 007316C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 006EFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 006F0668
Part of subcall function 006EFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 006F0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
GetLastError.KERNEL32 ref: 0073174A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 67ee4c614392e7b71d822914a7bbb3476eb2fbb4584f67e092bed40dea54b012
Instruction ID: 058585ce52833b0e7ae5efef695a214eb2aea3def8902183c3392c42866e24c2
Opcode Fuzzy Hash: 67ee4c614392e7b71d822914a7bbb3476eb2fbb4584f67e092bed40dea54b012
Instruction Fuzzy Hash: 0011C1B2404309AFE718AF54DC86D6ABBBDEF04754B24852EE05657242EB75BC418B24

Function 0073D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0073D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073D650

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 92cd15ec0e4607a55dfc0f5c3501bdad32f40509ec84ba31778af0b7981eb8b4
Instruction ID: 4b94de717043dfe8f0183ecbf240466d265ef23043a4e2c3a595e0f54d22b1a6
Opcode Fuzzy Hash: 92cd15ec0e4607a55dfc0f5c3501bdad32f40509ec84ba31778af0b7981eb8b4
Instruction Fuzzy Hash: 4C117C71E01228BFEB208F95EC45FAFBBBCEB45B50F108111F914E7290C2B44A058BA1

Function 00731663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0073168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007316A1
FreeSid.ADVAPI32(?), ref: 007316B1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: fe61f2be3367b20cc2006f2da4fc4e16b2eacfb869aaa6c095d1f1dea4584750
Instruction ID: ce25ff58142e55fb1f2cacf6199394dbe537d454f2c16ef468f29fa9f995e1fd
Opcode Fuzzy Hash: fe61f2be3367b20cc2006f2da4fc4e16b2eacfb869aaa6c095d1f1dea4584750
Instruction Fuzzy Hash: 29F0F471950309FBEB00DFE49D89AAEBBBCEB08604F508565E601E2181E778AA448A54

Function 006F4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D09
TerminateProcess.KERNEL32(00000000,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D10
ExitProcess.KERNEL32 ref: 006F4D22

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction ID: 53034d1fc41a8cb638c4b4dab46f84ac2bb22d4284ca608a6440f235a070d544
Opcode Fuzzy Hash: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction Fuzzy Hash: A8E0B63100024CABDF12AF55DD09AAA3F6AEF86781B108018FD569A722DB79DD42CA84

Function 0072D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0072D28C

Strings

X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: b8cfc341ca2d6c387d59d4fa769c0111609583b75a211ffec9d90fcdf6681f46
Instruction ID: 1119d53399aea9467d0e0056da3568c405e23970d8a8cd78d314b90c0294ea57
Opcode Fuzzy Hash: b8cfc341ca2d6c387d59d4fa769c0111609583b75a211ffec9d90fcdf6681f46
Instruction Fuzzy Hash: 8BD0C9B480122DEACB90CB90EC88DE9B3BCBB04305F104151F106A2000D77495498F20

Function 006FCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: ba0365c1a72ca61a4afb93015a2935d88e6a427ea186bc285cec63f6549ed68a
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 73020B71E0111D9BDF14CFA9C9806EDFBB2EF48324F254169D919EB384D731A941CB94

Function 006DCAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#z, xrefs: 006DCF7F
Variable is not of type 'Object'., xrefs: 00720C40

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#z
API String ID: 0-3775082255
Opcode ID: 2b2230264f9036a6b7ef5ae2f22c9632185e040574402513bdd23d2de17903f9
Instruction ID: c77ace521d97e9d5065aeab2a68c06def175dfd7d0993c73d22dcdbcd5200f6e
Opcode Fuzzy Hash: 2b2230264f9036a6b7ef5ae2f22c9632185e040574402513bdd23d2de17903f9
Instruction Fuzzy Hash: 44327B70D00219DBCF14DF94D895AEDB7B6FF05314F24805AE806AB392D779AE46CBA0

Function 007468EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00746918
FindClose.KERNEL32(00000000), ref: 00746961

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b0fbcef897da9bea61239b0c047e1023915fba8999aefa7a7093640c398d35d2
Instruction ID: 2b3f235004075b184e7897b598c60a9ae3230abdf1cd7d8b6e16b88bbccaa9a2
Opcode Fuzzy Hash: b0fbcef897da9bea61239b0c047e1023915fba8999aefa7a7093640c398d35d2
Instruction Fuzzy Hash: DC1190716042019FD710DF29D484A26BBE5FF85328F14C69EE8698F3A2CB74EC05CB91

Function 007437B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00754891,?,?,00000035,?), ref: 007437E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00754891,?,?,00000035,?), ref: 007437F4

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: eeeb3748f0d9b9cd206abbd29b1514b920e9d5f0827959c6d410a24b046f5aba
Instruction ID: 451ca3856260a129efc65e0ee2f8adc78b029877127fe934cec231ddd7e37ac2
Opcode Fuzzy Hash: eeeb3748f0d9b9cd206abbd29b1514b920e9d5f0827959c6d410a24b046f5aba
Instruction Fuzzy Hash: 7CF0E5B06053286AE76117668C8DFEB3AAEEFC4761F004265F509D22C1DAB49944C6B0

Function 007310BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007311FC), ref: 007310D4
CloseHandle.KERNEL32(?,?,007311FC), ref: 007310E9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 39947808edeefef5c463c200ff473ad94b62f3cb04ad6bafbbed752f7b537983
Instruction ID: 0472cc47743c23b4a69a508b70ba4da402f138558793fee8756d09e48af970e2
Opcode Fuzzy Hash: 39947808edeefef5c463c200ff473ad94b62f3cb04ad6bafbbed752f7b537983
Instruction Fuzzy Hash: 08E04F32008740AFF7262B12FC05E777BA9EF04310F10C82DF4A6804B1DBA26C90DB14

Function 006DBF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#z, xrefs: 007207CE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#z
API String ID: 3964851224-2781437441
Opcode ID: db30527f3231b154ff62a2df3db0ea35b0b7880e29322f6374912109f721345b
Instruction ID: 8bf7a7f724639f46705f99f24b0665224643b1b2148bf040f0109dbad4b50b56
Opcode Fuzzy Hash: db30527f3231b154ff62a2df3db0ea35b0b7880e29322f6374912109f721345b
Instruction Fuzzy Hash: 0FA27D70A08355DFD710CF18C480B6ABBE2BF89314F14896EE89A9B352D775EC45CB92

Function 0070676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00706766,?,?,00000008,?,?,0070FEFE,00000000), ref: 00706998

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bafe0fec2148d9f80ad823e64421f9f7561004f523f59739c99b8bdad8f904e5
Instruction ID: 7e1ce935d055ed727ac09b44ab553ceba95f5c1b5a756cb68a1575e2e3a477ea
Opcode Fuzzy Hash: bafe0fec2148d9f80ad823e64421f9f7561004f523f59739c99b8bdad8f904e5
Instruction Fuzzy Hash: D1B10571610608DFDB15CF28C49AB657BE0FB45364F25C658E899CF2E2C339E9A1CB40

Function 006EB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0072851F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 302f7e0a285ee33d16a564a68d366b9222082ee351ff8102c472410c7a6da864
Instruction ID: 0a38e2fa34a2571865719cf329d9a6ff479ba65fcd3c584dcf644860f6bfdf72
Opcode Fuzzy Hash: 302f7e0a285ee33d16a564a68d366b9222082ee351ff8102c472410c7a6da864
Instruction Fuzzy Hash: 11127F71901229DBCB54CF59D881AEEB7F5FF48310F1481AAE809EB255EB349E81CF91

Function 0074EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0074EABD

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f3d81005c38b7611183402324b452e2980b936fdf5a5f03f3ac515f1accfb41a
Instruction ID: 40037cca7cd9eb2455f7838ba556cfbcf0cf3592421f0df82704f92a4fce4f06
Opcode Fuzzy Hash: f3d81005c38b7611183402324b452e2980b936fdf5a5f03f3ac515f1accfb41a
Instruction Fuzzy Hash: 11E01A312002059FC710EF59D804EAAB7E9BF98770F00C41AFD8AC7361DBB4A8408B94

Function 006F09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006F03EE), ref: 006F09DA

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f489ea8c91d0fb0b7a3c1d3df5387af7881b36bf58a62d3a021276c51cd31ab5
Instruction ID: affbd668b4b02449cdead1a49988709635f711dc891ddf25beb500da3dd9948e
Opcode Fuzzy Hash: f489ea8c91d0fb0b7a3c1d3df5387af7881b36bf58a62d3a021276c51cd31ab5
Instruction Fuzzy Hash:

Function 006F781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 006F798B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 49cd43dd53e8c6a144dd8756219a9541778ea1c39d6a0f3090c4c4d325dec89c
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 6951797160C70D5BDB388968885E7FE67DB9B12380F18052EEB92D7382CA55DE03D35A

Function 00742046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&z, xrefs: 00742053

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: 0&z
API String ID: 0-2820941700
Opcode ID: d13d7ad5f396863204dd0080da75ade720c532cb8c51b8f80897acd95b46c113
Instruction ID: 78fa2d245e396c6b82c44dd04dae84c5b4ab51d1a6adbcccf999210eff2e8e03
Opcode Fuzzy Hash: d13d7ad5f396863204dd0080da75ade720c532cb8c51b8f80897acd95b46c113
Instruction Fuzzy Hash: BD21E7323216118BD728CF79C82367E73E5A794310F148A2EE4A7C37D1DE3AA905CB84

Function 00706DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c2066cb2894a89233c51479eac4db81d8b812cabec05727c6e5fca42b3365f
Instruction ID: 381d433856c0a6ee5eb19534b33c23f731c6521d023dbd8b145d0cc7e36860a5
Opcode Fuzzy Hash: a9c2066cb2894a89233c51479eac4db81d8b812cabec05727c6e5fca42b3365f
Instruction Fuzzy Hash: 9D32F221D29F418DD7279634CC22335A689AFB73C5F15D737E82AB59AAEB2DD4C38100

Function 006ECC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e82e2b8fff1fdea07d106e46cdf284e001a0bed0978d97c4c53d528e9ae46c9
Instruction ID: aaca0146c2dc89ad00afd5e2e1306f3546f902c4b8fff4ad2527d53b354d3168
Opcode Fuzzy Hash: 5e82e2b8fff1fdea07d106e46cdf284e001a0bed0978d97c4c53d528e9ae46c9
Instruction Fuzzy Hash: FA323931A002A58BDF26CF29E490ABD77B2EF55310F38816AE449DB391D63CDD82DB51

Function 006D7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8feb3cdec79cc59b2f7e8872175f0a2528a6254aa0bf4fd7f46786bc680dedab
Instruction ID: a7fd4614074684c2e14e2281b999083a289a15b8dd61a8c58ccfec64ab8c6b87
Opcode Fuzzy Hash: 8feb3cdec79cc59b2f7e8872175f0a2528a6254aa0bf4fd7f46786bc680dedab
Instruction Fuzzy Hash: A7229F70E04609DFDF18CF68C881AEEB7B6FF44300F14462AE816A7391EB39A955CB55

Function 006D91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb5a6a28cf3a4646e3cb8110be5938e9cdf0b5578eecb21ee4ac08c53d67528
Instruction ID: 019e2c88f922e2e323763c35d3a9862419e3fe54cc70df31c9e81240140fddc2
Opcode Fuzzy Hash: fdb5a6a28cf3a4646e3cb8110be5938e9cdf0b5578eecb21ee4ac08c53d67528
Instruction Fuzzy Hash: 7E02A6B1E0020AEBDB14DF58D881AADB7B2FF44300F118169E8569B3D1EB35EE51CB95

Function 00709EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1870d53144253e3904f71048e378fb4d0a8466274a12a85a0d8179a41fcf9495
Instruction ID: 8cd8e395bc7840e926b3509bd70da8728301f5e7ea645e5e12885a45d13bb84f
Opcode Fuzzy Hash: 1870d53144253e3904f71048e378fb4d0a8466274a12a85a0d8179a41fcf9495
Instruction Fuzzy Hash: 86B11320D2AF414DD32396398831336B69CAFBB6D5F91D31BFC2A74D62EB2686C35141

Function 006F1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 313c1b9d5e4f17cc4fab098aa733790564b094a5e966aa06df392a1b4ff979ac
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: EF9186726080A78ADB29463E85740BEFFF25E933E131A079DD5F2CE2C5EE24C955D620

Function 006F1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 552d44dae5f2c8668132fc668812542c208c8c53606dfbe217fdc3a6fdffac3c
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 0D9158736090A74AD76D823A857407EFFE35A933A131A079DD6F2CF2C5EE248554DA20

Function 006F19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 48ef3eac350dbd7072957ac9b0e768a3e045c12662c550967848adc2fcb8dbc9
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 599152722090ABCADB2D427A857407DFFE25A933E231A079ED5F2CE2C1FD14C6559620

Function 006F7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a27130f7ea7df12b1d90b501ae831a013f3873148f0a08b9036079981984457
Instruction ID: 6834b538051ee04cdaa27bc7852b169284fef0925481475f05999aaa2a527a22
Opcode Fuzzy Hash: 4a27130f7ea7df12b1d90b501ae831a013f3873148f0a08b9036079981984457
Instruction Fuzzy Hash: 5461677120C70E9AEE749E2C8D95BFE2397DF52704F10095EEB42DB381DA51AE42C319

Function 006F7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce18890b009c9d1ea0a50a033c640a930bf900d30e7c0a9526041f981020174
Instruction ID: c0bb6f476d9b33720590524def0e98de7b3ce2365d4b6b4e72c523cbe3c40260
Opcode Fuzzy Hash: 7ce18890b009c9d1ea0a50a033c640a930bf900d30e7c0a9526041f981020174
Instruction Fuzzy Hash: 2E61693160870D56DE388A289856BFF239BEF42704F90195EEB42DB381DA529D42C359

Function 006F1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 05cc462719febcc2cc4e493965056763b16b35087ac5558fbe30128067800669
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 9A8176325090A78ADB2D427A85340BEFFE35A933E131A079DD5F6CF2C1EE14D554E660

Function 00752ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00752B30
DeleteObject.GDI32(00000000), ref: 00752B43
DestroyWindow.USER32 ref: 00752B52
GetDesktopWindow.USER32 ref: 00752B6D
GetWindowRect.USER32(00000000), ref: 00752B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00752CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00752CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752CF8
GetClientRect.USER32(00000000,?), ref: 00752D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00752D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DA8
GlobalFree.KERNEL32(00000000), ref: 00752DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0076FC38,00000000), ref: 00752DDB
GlobalFree.KERNEL32(00000000), ref: 00752DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00752E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00752E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075303F

Strings

, xrefs: 00752FC5
static, xrefs: 00752D3A, 00752E91
DISPLAY, xrefs: 00752EA2
AutoIt v3, xrefs: 00752CF2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: f5595ed05157340c7329c10a2d959f1f58b19d3bff0d5c2eab9e6e32c35dd2e4
Instruction ID: 14c82aa4abbbfd0fa01d2a284d004b6a8ef68a0de11b8e12991e8fc07b1321b2
Opcode Fuzzy Hash: f5595ed05157340c7329c10a2d959f1f58b19d3bff0d5c2eab9e6e32c35dd2e4
Instruction Fuzzy Hash: 89029F71900209EFDB15DF64DC89EAE7BB9FB49311F008109F915AB2A1DBB8AD05CF64

Function 007670D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0076712F
GetSysColorBrush.USER32(0000000F), ref: 00767160
GetSysColor.USER32(0000000F), ref: 0076716C
SetBkColor.GDI32(?,000000FF), ref: 00767186
SelectObject.GDI32(?,?), ref: 00767195
InflateRect.USER32(?,000000FF,000000FF), ref: 007671C0
GetSysColor.USER32(00000010), ref: 007671C8
CreateSolidBrush.GDI32(00000000), ref: 007671CF
FrameRect.USER32(?,?,00000000), ref: 007671DE
DeleteObject.GDI32(00000000), ref: 007671E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00767230
FillRect.USER32(?,?,?), ref: 00767262
GetWindowLongW.USER32(?,000000F0), ref: 00767284

Part of subcall function 007673E8: GetSysColor.USER32(00000012), ref: 00767421
Part of subcall function 007673E8: SetTextColor.GDI32(?,?), ref: 00767425
Part of subcall function 007673E8: GetSysColorBrush.USER32(0000000F), ref: 0076743B
Part of subcall function 007673E8: GetSysColor.USER32(0000000F), ref: 00767446
Part of subcall function 007673E8: GetSysColor.USER32(00000011), ref: 00767463
Part of subcall function 007673E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00767471
Part of subcall function 007673E8: SelectObject.GDI32(?,00000000), ref: 00767482
Part of subcall function 007673E8: SetBkColor.GDI32(?,00000000), ref: 0076748B
Part of subcall function 007673E8: SelectObject.GDI32(?,?), ref: 00767498
Part of subcall function 007673E8: InflateRect.USER32(?,000000FF,000000FF), ref: 007674B7
Part of subcall function 007673E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007674CE
Part of subcall function 007673E8: GetWindowLongW.USER32(00000000,000000F0), ref: 007674DB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 0d0dfc5d666063d3d6559b2a8241fe8d376ae5c31c70e83b7dfa47b02ad8a788
Instruction ID: 4b0e5bbc4b233345bf4b39c2bd8dd3a77010c4f2737830aa4d694ecc755e83cf
Opcode Fuzzy Hash: 0d0dfc5d666063d3d6559b2a8241fe8d376ae5c31c70e83b7dfa47b02ad8a788
Instruction Fuzzy Hash: F6A1C172008305EFDB069F60DC48E6B7BA9FF89364F104A19F9A3961E1D7B8E844CB55

Function 006E8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 006E8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00726AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00726AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00726F43

Part of subcall function 006E8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006E8BE8,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8FC5

SendMessageW.USER32(?,00001053), ref: 00726F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00726F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00726FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00726FB7

Strings

0, xrefs: 00726DCF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 3f420435c19c67cce9ef405d329a357a3800991e6031a5731dfce5f5256c87bd
Instruction ID: c724ab0eb826f205c56a2924846857079c5eaca632d4beb3d7aa03b8300cf4ff
Opcode Fuzzy Hash: 3f420435c19c67cce9ef405d329a357a3800991e6031a5731dfce5f5256c87bd
Instruction Fuzzy Hash: AB12DE306012A1DFDB25DF24E844BB6B7E2FB45300F54846AF5898B261CB39EC92DF95

Function 00752711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0075273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0075286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 007528A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 007528B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00752900
GetClientRect.USER32(00000000,?), ref: 0075290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00752955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00752964
GetStockObject.GDI32(00000011), ref: 00752974
SelectObject.GDI32(00000000,00000000), ref: 00752978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00752988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00752991
DeleteDC.GDI32(00000000), ref: 0075299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007529C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 007529DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00752A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00752A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00752A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00752A77
GetStockObject.GDI32(00000011), ref: 00752A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00752A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00752A97

Strings

static, xrefs: 0075294F, 00752A71
msctls_progress32, xrefs: 00752A13
DISPLAY, xrefs: 0075295A
AutoIt v3, xrefs: 007528F8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: d18e94631bf90796df279ce995486a89449f235ee8da0f223f79b8259d6598ab
Instruction ID: 3b431d28ec751e0e2ab31efd205dc064d2ec17bd1ac2c34280db8d5a36c3aeaa
Opcode Fuzzy Hash: d18e94631bf90796df279ce995486a89449f235ee8da0f223f79b8259d6598ab
Instruction Fuzzy Hash: 6EB19FB1A00215AFEB14DFA8DC45FAE7BA9EB49711F008115F915E7291D7B8ED00CF98

Function 00744ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00744AED
GetDriveTypeW.KERNEL32(?,0076CB68,?,\\.\,0076CC08), ref: 00744BCA
SetErrorMode.KERNEL32(00000000,0076CB68,?,\\.\,0076CC08), ref: 00744D36

Strings

USB, xrefs: 00744CB4
SATA, xrefs: 00744CD0
Network, xrefs: 00744C02
FileBackedVirtual, xrefs: 00744CEC
PhysicalDrive, xrefs: 00744B76
Fixed, xrefs: 00744C09
SCSI, xrefs: 00744C8A
SAS, xrefs: 00744CC9
SSA, xrefs: 00744CA6
MMC, xrefs: 00744CDE
RAMDisk, xrefs: 00744BF4
Fibre, xrefs: 00744CAD
Removable, xrefs: 00744C10, 00744C15
Virtual, xrefs: 00744CE5
ATA, xrefs: 00744C98
SSD, xrefs: 00744C4A
iSCSI, xrefs: 00744CC2
\\.\, xrefs: 00744B3F
RAID, xrefs: 00744CBB
Unknown, xrefs: 00744BED, 00744C83
CDROM, xrefs: 00744BFB
1394, xrefs: 00744C9F
ATAPI, xrefs: 00744C91

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 529dcb761114f399433c4dfc1f8dca62882209177102c791c74b0f918ba0c289
Instruction ID: 3a58bc7a985b63cb0183a992cc02bb70f01550bdfcd92e2eeda452b9ffbda9ef
Opcode Fuzzy Hash: 529dcb761114f399433c4dfc1f8dca62882209177102c791c74b0f918ba0c289
Instruction Fuzzy Hash: 7E61AFB0B05205DBCF04DF24DAD2A78B7B1EB05341B28851AF806AB691DB3DED41FB65

Function 007673E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00767421
SetTextColor.GDI32(?,?), ref: 00767425
GetSysColorBrush.USER32(0000000F), ref: 0076743B
GetSysColor.USER32(0000000F), ref: 00767446
CreateSolidBrush.GDI32(?), ref: 0076744B
GetSysColor.USER32(00000011), ref: 00767463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00767471
SelectObject.GDI32(?,00000000), ref: 00767482
SetBkColor.GDI32(?,00000000), ref: 0076748B
SelectObject.GDI32(?,?), ref: 00767498
InflateRect.USER32(?,000000FF,000000FF), ref: 007674B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007674CE
GetWindowLongW.USER32(00000000,000000F0), ref: 007674DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0076752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00767554
InflateRect.USER32(?,000000FD,000000FD), ref: 00767572
DrawFocusRect.USER32(?,?), ref: 0076757D
GetSysColor.USER32(00000011), ref: 0076758E
SetTextColor.GDI32(?,00000000), ref: 00767596
DrawTextW.USER32(?,007670F5,000000FF,?,00000000), ref: 007675A8
SelectObject.GDI32(?,?), ref: 007675BF
DeleteObject.GDI32(?), ref: 007675CA
SelectObject.GDI32(?,?), ref: 007675D0
DeleteObject.GDI32(?), ref: 007675D5
SetTextColor.GDI32(?,?), ref: 007675DB
SetBkColor.GDI32(?,?), ref: 007675E5

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: d2b58d116f32d9d9e499e49b420ad155f488c9c7d43693f6fc9fe85d081d473b
Instruction ID: 5e77953fe0ae5e53e073ba6c4d726d11ad724c936057cc3fc1a2ae2c0381b77a
Opcode Fuzzy Hash: d2b58d116f32d9d9e499e49b420ad155f488c9c7d43693f6fc9fe85d081d473b
Instruction Fuzzy Hash: 2C616072900218AFDF069FA4DC49EAE7F79EF09360F118115F916AB2A1D7B89940CF94

Function 00760FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00761128
GetDesktopWindow.USER32 ref: 0076113D
GetWindowRect.USER32(00000000), ref: 00761144
GetWindowLongW.USER32(?,000000F0), ref: 00761199
DestroyWindow.USER32(?), ref: 007611B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007611ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0076120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0076121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00761232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00761245
IsWindowVisible.USER32(00000000), ref: 007612A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 007612BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 007612D0
GetWindowRect.USER32(00000000,?), ref: 007612E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0076130E
GetMonitorInfoW.USER32(00000000,?), ref: 00761328
CopyRect.USER32(?,?), ref: 0076133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 007613AA

Strings

0, xrefs: 007610D3
(, xrefs: 0076131B
tooltips_class32, xrefs: 007611E6

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 51f1f5a2ef300bdacf789e752000f07e32a24241baa57f5194a2af815d7a2a3f
Instruction ID: dfedbd7fac7fcbcedf2abbcb37c2fb22ad7444279f19c7ed3efc658e5483ad75
Opcode Fuzzy Hash: 51f1f5a2ef300bdacf789e752000f07e32a24241baa57f5194a2af815d7a2a3f
Instruction Fuzzy Hash: 90B1BC71604341AFDB44DF64C888B6ABBE4FF88300F44891DF99A9B2A1C774E844CB96

Function 006E8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006E8968
GetSystemMetrics.USER32(00000007), ref: 006E8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006E899B
GetSystemMetrics.USER32(00000008), ref: 006E89A3
GetSystemMetrics.USER32(00000004), ref: 006E89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006E89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006E89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 006E8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 006E8A3C
GetClientRect.USER32(00000000,000000FF), ref: 006E8A5A
GetStockObject.GDI32(00000011), ref: 006E8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 006E8A81

Part of subcall function 006E912D: GetCursorPos.USER32(?), ref: 006E9141
Part of subcall function 006E912D: ScreenToClient.USER32(00000000,?), ref: 006E915E
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000001), ref: 006E9183
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000002), ref: 006E919D

SetTimer.USER32(00000000,00000000,00000028,006E90FC), ref: 006E8AA8

Strings

AutoIt v3 GUI, xrefs: 006E8A20

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 9fb41df80659fe5d5ccd82e4f0b1007f31d26dd35ee8d60c26ccf96f5590859d
Instruction ID: fe331e6d99001d01456d9528e8ce7a5db171a5cce4727d6a11fed194aaf2b0c1
Opcode Fuzzy Hash: 9fb41df80659fe5d5ccd82e4f0b1007f31d26dd35ee8d60c26ccf96f5590859d
Instruction Fuzzy Hash: 00B18F75A003599FDB14DFA8DC45BAE3BB5FB48314F10822AFA16A7290DB78E841CF54

Function 00730D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
Part of subcall function 007310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
Part of subcall function 007310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
Part of subcall function 007310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00730DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00730E29
GetLengthSid.ADVAPI32(?), ref: 00730E40
GetAce.ADVAPI32(?,00000000,?), ref: 00730E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00730E96
GetLengthSid.ADVAPI32(?), ref: 00730EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00730EB5
HeapAlloc.KERNEL32(00000000), ref: 00730EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00730EDD
CopySid.ADVAPI32(00000000), ref: 00730EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00730F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00730F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00730F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F6E
HeapFree.KERNEL32(00000000), ref: 00730F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F7E
HeapFree.KERNEL32(00000000), ref: 00730F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F8E
HeapFree.KERNEL32(00000000), ref: 00730F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00730FA1
HeapFree.KERNEL32(00000000), ref: 00730FA8

Part of subcall function 00731193: GetProcessHeap.KERNEL32(00000008,00730BB1,?,00000000,?,00730BB1,?), ref: 007311A1
Part of subcall function 00731193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00730BB1,?), ref: 007311A8
Part of subcall function 00731193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00730BB1,?), ref: 007311B7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: e0830977437497ec22398bdbf383c3b791d1770c116ca8d3355a8563cac0c123
Instruction ID: c366cb2ccd8912e91f2d12477ee66689e63de2c464b4d817d65b030004802b09
Opcode Fuzzy Hash: e0830977437497ec22398bdbf383c3b791d1770c116ca8d3355a8563cac0c123
Instruction Fuzzy Hash: 79715FB190020AEBEF219FA4DC49FBEBBB8BF05700F048115F959A6152D7799A05CBA0

Function 0075C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0076CC08,00000000,?,00000000,?,?), ref: 0075C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0075C5A4
_wcslen.LIBCMT ref: 0075C5F4
_wcslen.LIBCMT ref: 0075C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0075C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0075C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0075C84D
RegCloseKey.ADVAPI32(?), ref: 0075C881
RegCloseKey.ADVAPI32(00000000), ref: 0075C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0075C960

Strings

REG_MULTI_SZ, xrefs: 0075C6F5
REG_SZ, xrefs: 0075C644
REG_DWORD, xrefs: 0075C804
REG_EXPAND_SZ, xrefs: 0075C5CD
REG_BINARY, xrefs: 0075C913
REG_QWORD, xrefs: 0075C8C3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: cbc8732d21ec912f60940550898a7d8a734b144683abdf98bcb01fb15843986a
Instruction ID: 3d1e5a5c1bf9f969cf39678abe4ae1ea190436f0a9e9305c36b4f5bb90e4cf64
Opcode Fuzzy Hash: cbc8732d21ec912f60940550898a7d8a734b144683abdf98bcb01fb15843986a
Instruction Fuzzy Hash: 041265316043019FDB15DF14C881B6AB7E6EF88714F04889DF88A9B3A2DB75ED45CB86

Function 0076091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007609C6
_wcslen.LIBCMT ref: 00760A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00760A54
_wcslen.LIBCMT ref: 00760A8A
_wcslen.LIBCMT ref: 00760B06
_wcslen.LIBCMT ref: 00760B81

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

Part of subcall function 00732BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00732BFA

Strings

UNCHECK, xrefs: 00760D3E
EXISTS, xrefs: 00760B7C, 00760B97
ISCHECKED, xrefs: 00760CE1
EXPAND, xrefs: 00760BF8
GETTOTALCOUNT, xrefs: 007609F2, 00760A17
GETTEXT, xrefs: 00760C97
GETSELECTED, xrefs: 00760C4E
CHECK, xrefs: 00760A85, 00760AA0
GETITEMCOUNT, xrefs: 00760C1E
COLLAPSE, xrefs: 00760B01, 00760B1C
SELECT, xrefs: 00760D11

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: b4af81b1ddc4968bd0f79cd10d5f0c44f1160a1528fd0e358bf02ff7ce68ed49
Instruction ID: 04dbe636cf8e561c7d453acd2a8e7893e6bc889a1034b387f0f490ce66d3a86b
Opcode Fuzzy Hash: b4af81b1ddc4968bd0f79cd10d5f0c44f1160a1528fd0e358bf02ff7ce68ed49
Instruction Fuzzy Hash: B1E19B716087018FCB14DF24C45092BB7E2BF98354F148A5DF89A9B3A2DB39ED45CB92

Function 0075C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
_wcslen.LIBCMT ref: 0075C9F1
_wcslen.LIBCMT ref: 0075CA68
_wcslen.LIBCMT ref: 0075CA9E
_wcslen.LIBCMT ref: 0075CAF9
_wcslen.LIBCMT ref: 0075CB2F
_wcslen.LIBCMT ref: 0075CB7F

Strings

HKEY_CURRENT_USER, xrefs: 0075CBBD
HKLM, xrefs: 0075CA98, 0075CA9D
HKCC, xrefs: 0075CBAC
HKU, xrefs: 0075CBF0
HKEY_CLASSES_ROOT, xrefs: 0075CAF3, 0075CAF8
HKCU, xrefs: 0075CBCE
HKEY_USERS, xrefs: 0075CBDF
HKCR, xrefs: 0075CB29, 0075CB2E
HKEY_LOCAL_MACHINE, xrefs: 0075CA62, 0075CA67
HKEY_CURRENT_CONFIG, xrefs: 0075CB79, 0075CB7E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: de7dfea91e7efa3be898fd113bfdd0781fe4e29cbb1a4b5c8a086a0451928232
Instruction ID: f87b5bd4aac68ed4e85dc9caf4e280d90faeda04030946cff4c211237e982e9c
Opcode Fuzzy Hash: de7dfea91e7efa3be898fd113bfdd0781fe4e29cbb1a4b5c8a086a0451928232
Instruction Fuzzy Hash: 2171163260036A8FCF22DE7CCD417FB37929B61751B244528FC56A7284EAB9CD48C3A4

Function 0076833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0076835A
_wcslen.LIBCMT ref: 0076836E
_wcslen.LIBCMT ref: 00768391
_wcslen.LIBCMT ref: 007683B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007683F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0076361A,?), ref: 0076844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00768487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007684CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00768501
FreeLibrary.KERNEL32(?), ref: 0076850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0076851D
DestroyIcon.USER32(?), ref: 0076852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00768549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00768555

Strings

.dll, xrefs: 007683AB
.exe, xrefs: 00768388
.icl, xrefs: 00768368

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: d1ff607b6ce1307a88a1248954ea99055940d1b6e9293a6d181f2625c7cc5108
Instruction ID: 9ed7bf26ed66169a14c575a7095c0dc1af235f3b816747f53ebc24dd89417597
Opcode Fuzzy Hash: d1ff607b6ce1307a88a1248954ea99055940d1b6e9293a6d181f2625c7cc5108
Instruction Fuzzy Hash: E861D171540219BAEB54DF64CC41BBF7BA8FB04711F10860AFD16D61D1DFB8AA50C7A4

Function 006D7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

", xrefs: 00715153
Unterminated group of comments, xrefs: 0071528C
#notrayicon, xrefs: 006D77E7
#cs, xrefs: 006D7873, 006D78C5
#OnAutoItStartRegister, xrefs: 006D7817
#comments-start, xrefs: 006D785F, 006D78B1
Bad directive syntax error, xrefs: 0071519A
#include-once, xrefs: 006D782F
#requireadmin, xrefs: 006D77FF
#comments-end, xrefs: 006D78D9
', xrefs: 00715169
#ce, xrefs: 006D78ED
Cannot parse #include, xrefs: 00715279
#pragma compile, xrefs: 006D77D3
#include, xrefs: 006D7847

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 5fa3bf0f092debea9656f1c9a24024266f07537a1dd82c47afb78d064ea446f4
Instruction ID: 38c1538164f9b5bcfe7b821dc5538857447e3ed4f05df522a62635104860f13a
Opcode Fuzzy Hash: 5fa3bf0f092debea9656f1c9a24024266f07537a1dd82c47afb78d064ea446f4
Instruction Fuzzy Hash: 978119B1A00209BBDB25AF64DC42FFE3766AF55300F04442AF905AB292FB74D941D7A5

Function 00743E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00743EF8
_wcslen.LIBCMT ref: 00743F03
_wcslen.LIBCMT ref: 00743F5A
_wcslen.LIBCMT ref: 00743F98
GetDriveTypeW.KERNEL32(?), ref: 00743FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0074401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00744059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00744087

Strings

close cd wait, xrefs: 00744072
open , xrefs: 00743FE5
open, xrefs: 00743F54, 00743F59
closed, xrefs: 00743F08, 00743F2D, 00743F46, 00743F7E, 00743F97
wait, xrefs: 00744044
close, xrefs: 00743EFE, 00743F18
set cd door , xrefs: 00744028
type cdaudio alias cd wait, xrefs: 00744001

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: c85443f483c883ddfefa8eb518896a8c5398ae8f7042af51f00d72eac4d9a302
Instruction ID: 0dcd8a8e3ee250eb6e91879e3510d7cedcbf96742f71129b1288e519a9a0b08c
Opcode Fuzzy Hash: c85443f483c883ddfefa8eb518896a8c5398ae8f7042af51f00d72eac4d9a302
Instruction Fuzzy Hash: 3D71F272A042119FC710EF24C88197AB7F5EF95754F104A2EF89693361EB34ED49CB91

Function 00735A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00735A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00735A40
SetWindowTextW.USER32(?,?), ref: 00735A57
GetDlgItem.USER32(?,000003EA), ref: 00735A6C
SetWindowTextW.USER32(00000000,?), ref: 00735A72
GetDlgItem.USER32(?,000003E9), ref: 00735A82
SetWindowTextW.USER32(00000000,?), ref: 00735A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00735AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00735AC3
GetWindowRect.USER32(?,?), ref: 00735ACC
_wcslen.LIBCMT ref: 00735B33
SetWindowTextW.USER32(?,?), ref: 00735B6F
GetDesktopWindow.USER32 ref: 00735B75
GetWindowRect.USER32(00000000), ref: 00735B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00735BD3
GetClientRect.USER32(?,?), ref: 00735BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00735C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00735C2F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: bd7462111b9fd9440a9b398c3dd00e82ef9826fbbcf745ab37f591e42f29a42c
Instruction ID: e5fc60b5c4976b6e09ffbd9301ec72b4a315fc50e295a05c331f14811f42206d
Opcode Fuzzy Hash: bd7462111b9fd9440a9b398c3dd00e82ef9826fbbcf745ab37f591e42f29a42c
Instruction Fuzzy Hash: 79718E71900B09EFEB21DFA8CE85BAEBBF5FF48704F104518E582A25A1D779E940CB54

Function 0074FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0074FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0074FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0074FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0074FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0074FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0074FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0074FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0074FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0074FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0074FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0074FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0074FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0074FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0074FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0074FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0074FECC
GetCursorInfo.USER32(?), ref: 0074FEDC
GetLastError.KERNEL32 ref: 0074FF1E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: b9bd6578fdb0542bfbe5df724c818f1999687119968f7eef67c35dd8f9d982e5
Instruction ID: c7373e4607208230f9f0684cca614715d18e56ac13d1e5f1113bb22cd0a8167c
Opcode Fuzzy Hash: b9bd6578fdb0542bfbe5df724c818f1999687119968f7eef67c35dd8f9d982e5
Instruction Fuzzy Hash: AE4144B0D443196BDB109FBA8C85C5EBFE8FF04754B50452AF11DE7281DB789901CE91

Function 007330F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073318D
_wcslen.LIBCMT ref: 007331F8

Strings

CLASSNN, xrefs: 007331F3, 00733204
INSTANCE, xrefs: 00733453
REGEXPCLASS, xrefs: 00733255, 00733266
CLASS, xrefs: 00733188, 007331A5
TEXT, xrefs: 0073347C
NAME, xrefs: 00733335, 00733346
[y, xrefs: 0073339A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[y
API String ID: 176396367-3387399910
Opcode ID: 98a7ece8accede00da7a48507520c300edbb011be0d88278d20f48b12fde8959
Instruction ID: 040b674cb789fe72fafa46d0a0cce46a2112abe4a959f54d375696d2b52a7210
Opcode Fuzzy Hash: 98a7ece8accede00da7a48507520c300edbb011be0d88278d20f48b12fde8959
Instruction Fuzzy Hash: 0FE1E632A005269BEF359FB8C4516FEFBB1BF44710F54812AE456E7242DB38AE4587D0

Function 006F00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006F00C6

Part of subcall function 006F00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(007A070C,00000FA0,44C5BA5D,?,?,?,?,007123B3,000000FF), ref: 006F011C
Part of subcall function 006F00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,007123B3,000000FF), ref: 006F0127
Part of subcall function 006F00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,007123B3,000000FF), ref: 006F0138
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 006F014E
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 006F015C
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 006F016A
Part of subcall function 006F00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006F0195
Part of subcall function 006F00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006F01A0

___scrt_fastfail.LIBCMT ref: 006F00E7

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

Strings

WakeAllConditionVariable, xrefs: 006F0162
SleepConditionVariableCS, xrefs: 006F0154
InitializeConditionVariable, xrefs: 006F0148
kernel32.dll, xrefs: 006F0133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 006F0122

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 6bd65af9ed493c8fa03855f3d70aad972db18e670e984b24461f714dbbb2fee1
Instruction ID: e24a7f522972086bf83ff5013222f03e4ca6482920ad853d092288d3f28995da
Opcode Fuzzy Hash: 6bd65af9ed493c8fa03855f3d70aad972db18e670e984b24461f714dbbb2fee1
Instruction Fuzzy Hash: D1210E726457196BFB11ABF4AC05B7A3396EB46B51F104539FD0293392DFBC6C008A98

Function 007444C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0076CC08), ref: 00744527
_wcslen.LIBCMT ref: 0074453B
_wcslen.LIBCMT ref: 00744599
_wcslen.LIBCMT ref: 007445F4
_wcslen.LIBCMT ref: 0074463F
_wcslen.LIBCMT ref: 007446A7

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

GetDriveTypeW.KERNEL32(?,00796BF0,00000061), ref: 00744743

Strings

removable, xrefs: 007445EA, 007445EF
unknown, xrefs: 00744708
cdrom, xrefs: 0074458F, 00744594
ramdisk, xrefs: 007446F1
fixed, xrefs: 00744635, 0074463A
network, xrefs: 0074469D, 007446A2
all, xrefs: 00744531, 00744536

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 2ff707f14f4fd79194ab6d13c4dbddac39cc9da941895c77acb8ac107f70ef58
Instruction ID: f34687a7da7809d218eba8213f9a73587bcce700bb4f577d60b9a33e96ab7d58
Opcode Fuzzy Hash: 2ff707f14f4fd79194ab6d13c4dbddac39cc9da941895c77acb8ac107f70ef58
Instruction Fuzzy Hash: D0B1F2716083029FC710DF28D890A7AB7E5BFA6760F504A1DF496C7291EB38D845DBA2

Function 0076911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DragQueryPoint.SHELL32(?,?), ref: 00769147

Part of subcall function 00767674: ClientToScreen.USER32(?,?), ref: 0076769A
Part of subcall function 00767674: GetWindowRect.USER32(?,?), ref: 00767710
Part of subcall function 00767674: PtInRect.USER32(?,?,00768B89), ref: 00767720

SendMessageW.USER32(?,000000B0,?,?), ref: 007691B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007691BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007691DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00769225
SendMessageW.USER32(?,000000B0,?,?), ref: 0076923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00769255
SendMessageW.USER32(?,000000B1,?,?), ref: 00769277
DragFinish.SHELL32(?), ref: 0076927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00769371

Strings

@GUI_DRAGID, xrefs: 007692E9
p#z, xrefs: 007692BB
@GUI_DRAGFILE, xrefs: 00769320
@GUI_DROPID, xrefs: 0076929E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#z
API String ID: 221274066-3231298687
Opcode ID: 756ad91427686e561ccce6e17cecd414268d9a8f7f0373d83dae252c36d10f58
Instruction ID: 20594622f7e8b337e6cbfa15bc3dedc2908bf26f51c96fc560a9fcf049e175f2
Opcode Fuzzy Hash: 756ad91427686e561ccce6e17cecd414268d9a8f7f0373d83dae252c36d10f58
Instruction Fuzzy Hash: 8E619B71508301AFC701DF60DC85DAFBBE9EFC9750F00492EF596922A0DB749A09CB66

Function 006D326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(007A1990), ref: 00712F8D
GetMenuItemCount.USER32(007A1990), ref: 0071303D
GetCursorPos.USER32(?), ref: 00713081
SetForegroundWindow.USER32(00000000), ref: 0071308A
TrackPopupMenuEx.USER32(007A1990,00000000,?,00000000,00000000,00000000), ref: 0071309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007130A9

Strings

0, xrefs: 006D327D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 48c1bc70b071fdbbcfdfe5dda439fcff4eb2da154057c46928184aaa816b0f13
Instruction ID: 312b12dc30439dbbb5635d9f7e9a28ea5d2ad112ed8205ad4770f427095123e0
Opcode Fuzzy Hash: 48c1bc70b071fdbbcfdfe5dda439fcff4eb2da154057c46928184aaa816b0f13
Instruction Fuzzy Hash: FB712A70A44215BEFB218F28CC49FEABF69FF04324F204207F5156A2E1C7B9A965CB55

Function 00766CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00766DEB

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00766E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00766E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00766E94
DestroyWindow.USER32(?), ref: 00766EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,006D0000,00000000), ref: 00766EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00766EFD
GetDesktopWindow.USER32 ref: 00766F16
GetWindowRect.USER32(00000000), ref: 00766F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00766F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00766F4D

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

Strings

0, xrefs: 00766D98
tooltips_class32, xrefs: 00766E58, 00766EDD

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 191b8d542b2494c2e41f250a23be50da6f5f320f2bbf34e9c88cdaa78826e270
Instruction ID: d87ebba7d47b521b59e25487d28d154e75642803ade32e3ee881fafeca5263a7
Opcode Fuzzy Hash: 191b8d542b2494c2e41f250a23be50da6f5f320f2bbf34e9c88cdaa78826e270
Instruction Fuzzy Hash: D2716674104340AFEB21CF18D844EBABBE9FB99304F84445EF99A87261C779E916CB19

Function 0074C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0074C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0074C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0074C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0074C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0074C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0074C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0074C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0074C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0074C5F0
InternetCloseHandle.WININET(00000000), ref: 0074C5FB

Strings

, xrefs: 0074C575

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: d3eaba74513dce57d48ef928219fc7d48b4ce0d210665a889e09e64584309048
Instruction ID: c7cd51456fce75c2fe57731f67fd84d72ab91f73504c1b401c987aa4210b7f58
Opcode Fuzzy Hash: d3eaba74513dce57d48ef928219fc7d48b4ce0d210665a889e09e64584309048
Instruction Fuzzy Hash: F9518EB1501308BFDB629F65C948ABBBBFCFF08344F108419F98696210DB78E914DB60

Function 0076856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00768592
GetFileSize.KERNEL32(00000000,00000000), ref: 007685A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 007685AD
CloseHandle.KERNEL32(00000000), ref: 007685BA
GlobalLock.KERNEL32(00000000), ref: 007685C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 007685D7
GlobalUnlock.KERNEL32(00000000), ref: 007685E0
CloseHandle.KERNEL32(00000000), ref: 007685E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 007685F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0076FC38,?), ref: 00768611
GlobalFree.KERNEL32(00000000), ref: 00768621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00768641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00768671
DeleteObject.GDI32(00000000), ref: 00768699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007686AF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: eb3c30d5affcfa0ccd82823cd27a89650dc7dd919516fa932f8fecbc162b5ce3
Instruction ID: 5ebb3cbf9c5c1b90859c4d049f1c11b3e252c764ba5b04a3f02b637f2a98c6dd
Opcode Fuzzy Hash: eb3c30d5affcfa0ccd82823cd27a89650dc7dd919516fa932f8fecbc162b5ce3
Instruction Fuzzy Hash: A8412875600208AFDB129FA5CC48EAA7BB8FF89B11F108159FD46E7261DB789D01CF25

Function 007414BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00741502
VariantCopy.OLEAUT32(?,?), ref: 0074150B
VariantClear.OLEAUT32(?), ref: 00741517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007415FB
VarR8FromDec.OLEAUT32(?,?), ref: 00741657
VariantInit.OLEAUT32(?), ref: 00741708
SysFreeString.OLEAUT32(?), ref: 0074178C
VariantClear.OLEAUT32(?), ref: 007417D8
VariantClear.OLEAUT32(?), ref: 007417E7
VariantInit.OLEAUT32(00000000), ref: 00741823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00741625
Default, xrefs: 007416AF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: f35a48bfc25e660197ddd12b1b69b03ab5c9b4d3bdff36d1c6e73d0b3417feca
Instruction ID: 5e126d131e37f5975fa5dc322948794febb279cdd899d2c5552e4875c3c40ff9
Opcode Fuzzy Hash: f35a48bfc25e660197ddd12b1b69b03ab5c9b4d3bdff36d1c6e73d0b3417feca
Instruction Fuzzy Hash: 4DD1E271A00219DBDB00FF65D885BB9FBB6BF44700F54815AF446AB280DB38EC91DBA1

Function 0075B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0075B80A
RegCloseKey.ADVAPI32(?), ref: 0075B87E
RegCloseKey.ADVAPI32(?), ref: 0075B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0075B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0075B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0075B922
FreeLibrary.KERNEL32(00000000), ref: 0075B983
RegCloseKey.ADVAPI32(00000000), ref: 0075B994

Strings

advapi32.dll, xrefs: 0075B8ED
RegDeleteKeyExW, xrefs: 0075B8FE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: ce366675221b07dc4a002bc98296aed2713ea70288fc0038b65e222dd3ddce04
Instruction ID: da68f1e1edd1ca2d0e375a5f745c1c7fdb33612ca775d12da4eda411db99b46f
Opcode Fuzzy Hash: ce366675221b07dc4a002bc98296aed2713ea70288fc0038b65e222dd3ddce04
Instruction Fuzzy Hash: 5FC16C30604201EFD714DF14C495F6ABBE5AF84319F14859DF89A8B3A2CBB9EC49CB91

Function 0075255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007525D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 007525E8
CreateCompatibleDC.GDI32(?), ref: 007525F4
SelectObject.GDI32(00000000,?), ref: 00752601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0075266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 007526AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 007526D0
SelectObject.GDI32(?,?), ref: 007526D8
DeleteObject.GDI32(?), ref: 007526E1
DeleteDC.GDI32(?), ref: 007526E8
ReleaseDC.USER32(00000000,?), ref: 007526F3

Strings

(, xrefs: 0075268D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 8885c36562006b672d28403e843af3b10b1d35b87272dac8ccbb3122f28b910d
Instruction ID: 339b68b6ccc4e8b2b747b313eb488de7da2ea882d66853ce70fb172437d29f44
Opcode Fuzzy Hash: 8885c36562006b672d28403e843af3b10b1d35b87272dac8ccbb3122f28b910d
Instruction Fuzzy Hash: FA6105B5D00219EFCF05CFA4D884AAEBBF5FF48310F208529E956A7251E7B4A941CF94

Function 0070DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0070DAA1

Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D659
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D66B
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D67D
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D68F
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6A1
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6B3
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6C5
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6D7
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6E9
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6FB
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D70D
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D71F
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D731

_free.LIBCMT ref: 0070DA96

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070DAB8
_free.LIBCMT ref: 0070DACD
_free.LIBCMT ref: 0070DAD8
_free.LIBCMT ref: 0070DAFA
_free.LIBCMT ref: 0070DB0D
_free.LIBCMT ref: 0070DB1B
_free.LIBCMT ref: 0070DB26
_free.LIBCMT ref: 0070DB5E
_free.LIBCMT ref: 0070DB65
_free.LIBCMT ref: 0070DB82
_free.LIBCMT ref: 0070DB9A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0b50f2e46493ae6a8fa6652d446d4f72f3fbf7efdec349bbdef2f80f4d200b3d
Instruction ID: 6018ebed41e9d267bea4c28b79fa41bbac574d83e224d63c9a569dc357b537f2
Opcode Fuzzy Hash: 0b50f2e46493ae6a8fa6652d446d4f72f3fbf7efdec349bbdef2f80f4d200b3d
Instruction Fuzzy Hash: B0313BB2604305DFEB31AAB9E849B5677E9FF00310F254629E449E71E2DB79BC41CB20

Function 0073365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0073369C
_wcslen.LIBCMT ref: 007336A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00733797
GetClassNameW.USER32(?,?,00000400), ref: 0073380C
GetDlgCtrlID.USER32(?), ref: 0073385D
GetWindowRect.USER32(?,?), ref: 00733882
GetParent.USER32(?), ref: 007338A0
ScreenToClient.USER32(00000000), ref: 007338A7
GetClassNameW.USER32(?,?,00000100), ref: 00733921
GetWindowTextW.USER32(?,?,00000400), ref: 0073395D

Strings

%s%u, xrefs: 00733734

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 5b86906b69c6d471b1fb5825197008676316b16e2cc47cdb9842836720eeaff3
Instruction ID: 77a44cab104a3df3e87f57f2509f6c521f3c2253fe6fecfc8bcadcfbe7e3cc6a
Opcode Fuzzy Hash: 5b86906b69c6d471b1fb5825197008676316b16e2cc47cdb9842836720eeaff3
Instruction Fuzzy Hash: FC91B371204706EFE725DF24C885BEAF7A9FF44314F008619FA9AC2151DB78EA45CBA1

Function 00734954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00734994
GetWindowTextW.USER32(?,?,00000400), ref: 007349DA
_wcslen.LIBCMT ref: 007349EB
CharUpperBuffW.USER32(?,00000000), ref: 007349F7
_wcsstr.LIBVCRUNTIME ref: 00734A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00734A64
GetWindowTextW.USER32(?,?,00000400), ref: 00734A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00734AE6
GetClassNameW.USER32(?,?,00000400), ref: 00734B20
GetWindowRect.USER32(?,?), ref: 00734B8B

Strings

ThumbnailClass, xrefs: 00734A6F, 00734AF1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: cc00528501475ab3f434850dab90e39b297c74276aaec789c25e82aa852bc4cc
Instruction ID: 3fb23d8e35cc4b88847fddd582befdc8fbffc90a06de1bce9d5188855df0817b
Opcode Fuzzy Hash: cc00528501475ab3f434850dab90e39b297c74276aaec789c25e82aa852bc4cc
Instruction Fuzzy Hash: 8691DE711042099FEB08CF14C985BBAB7E9FF84314F04846AFD869A196DB38FD45CBA5

Function 0073BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(007A1990,000000FF,00000000,00000030), ref: 0073BFAC
SetMenuItemInfoW.USER32(007A1990,00000004,00000000,00000030), ref: 0073BFE1
Sleep.KERNEL32(000001F4), ref: 0073BFF3
GetMenuItemCount.USER32(?), ref: 0073C039
GetMenuItemID.USER32(?,00000000), ref: 0073C056
GetMenuItemID.USER32(?,-00000001), ref: 0073C082
GetMenuItemID.USER32(?,?), ref: 0073C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0073C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0073C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0073C145

Strings

0, xrefs: 0073BF3D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 50759e5cca76878c798231182704d9c4e5b9416f9fe26721d4e73a18e09d5c98
Instruction ID: a37f1f355d6d5b16a9da03a675ae4c41083320ca69479def994fa2d3ec5e8057
Opcode Fuzzy Hash: 50759e5cca76878c798231182704d9c4e5b9416f9fe26721d4e73a18e09d5c98
Instruction Fuzzy Hash: 0A61B0B190034AEFEF16CF68CC88ABE7BB8EB05344F104055E952A3293C779AD14DB61

Function 0075CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0075CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0075CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0075CD48

Part of subcall function 0075CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0075CCAA
Part of subcall function 0075CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0075CCBD
Part of subcall function 0075CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0075CCCF
Part of subcall function 0075CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0075CD05
Part of subcall function 0075CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0075CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0075CCF3

Strings

advapi32.dll, xrefs: 0075CCB8
RegDeleteKeyExW, xrefs: 0075CCC9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 57230b7916e5c44c7b99b1be2f0fb1987dc9807ef0004c05555a77df9ebdcab5
Instruction ID: b8ba0860d2586482295cdb6391ca90cd043205d7a179a3e936eb068bd3f112d6
Opcode Fuzzy Hash: 57230b7916e5c44c7b99b1be2f0fb1987dc9807ef0004c05555a77df9ebdcab5
Instruction Fuzzy Hash: AF3170B1A01318BFDB229B90DC88EFFBB7CEF05741F004165E906E6140D6B89E49DAB4

Function 00743D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00743D40
_wcslen.LIBCMT ref: 00743D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00743D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00743DBE
RemoveDirectoryW.KERNEL32(?), ref: 00743DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00743E55
CloseHandle.KERNEL32(00000000), ref: 00743E60
CloseHandle.KERNEL32(00000000), ref: 00743E6B

Strings

\??\%s, xrefs: 00743D5B
:, xrefs: 00743D82
\, xrefs: 00743D77

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 3beba508eb6fb765d907c1012c108067378ff24e783ea408df0fe7f4e70cde52
Instruction ID: 3e2694ff55ff1c8c69f8b126240d10e10e447081ab6b0b1f6786e06245e609f3
Opcode Fuzzy Hash: 3beba508eb6fb765d907c1012c108067378ff24e783ea408df0fe7f4e70cde52
Instruction Fuzzy Hash: 3831B471A00209ABDB219BA1DC49FEF37BDEF89700F1041B5F619D6150E77897448B68

Function 0073E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0073E6B4

Part of subcall function 006EE551: timeGetTime.WINMM(?,?,0073E6D4), ref: 006EE555

Sleep.KERNEL32(0000000A), ref: 0073E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0073E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0073E727
SetActiveWindow.USER32 ref: 0073E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0073E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0073E773
Sleep.KERNEL32(000000FA), ref: 0073E77E
IsWindow.USER32 ref: 0073E78A
EndDialog.USER32(00000000), ref: 0073E79B

Strings

BUTTON, xrefs: 0073E719

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: fc667f9e1056235d70f9d9d2e829fa35b1041ac5780bf39ff9e35c545dc4f876
Instruction ID: 45b46c6be4eaf3b4137bb4aeeb3ae404af5ceccf8a5c06e72832753c35833b95
Opcode Fuzzy Hash: fc667f9e1056235d70f9d9d2e829fa35b1041ac5780bf39ff9e35c545dc4f876
Instruction Fuzzy Hash: 0D2184B0241305EFFB125F64EC99A353B69F796348F108425F55682AE3DBBD9C118B2C

Function 0073E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0073EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0073EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0073EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0073EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0073EAA7

Strings

open , xrefs: 0073EA0C
play PlayMe wait, xrefs: 0073EA91
alias PlayMe, xrefs: 0073EA36
play PlayMe, xrefs: 0073EAA2
close PlayMe, xrefs: 0073EA6E, 0073EA9B
status PlayMe mode, xrefs: 0073EA58

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 7bf90f6dafb71b8cf3497a45f062c5af8be2aaa790c8b2f9799816e7afe02a1a
Instruction ID: 8c738fe0caa5d1a88ce1add17fe38ff80b08772ae4c49754e8bac7581892db83
Opcode Fuzzy Hash: 7bf90f6dafb71b8cf3497a45f062c5af8be2aaa790c8b2f9799816e7afe02a1a
Instruction Fuzzy Hash: C6117371A5026979EB20A7A2EC4AEFF6B7CEBD1F50F00452EB401A21D1EEB45D05C5B0

Function 00735CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00735CE2
GetWindowRect.USER32(00000000,?), ref: 00735CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00735D59
GetDlgItem.USER32(?,00000002), ref: 00735D69
GetWindowRect.USER32(00000000,?), ref: 00735D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00735DCF
GetDlgItem.USER32(?,000003E9), ref: 00735DDD
GetWindowRect.USER32(00000000,?), ref: 00735DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00735E31
GetDlgItem.USER32(?,000003EA), ref: 00735E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00735E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00735E67

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 84c38101670eb317aa8a9116b6d30fffbca60a82bfc25b16431c40b213f7cd46
Instruction ID: 270efe1b0e20eff5c49428aa34c8725e81bc6462c3f629ca918c95c07a98c087
Opcode Fuzzy Hash: 84c38101670eb317aa8a9116b6d30fffbca60a82bfc25b16431c40b213f7cd46
Instruction Fuzzy Hash: 49512FB1B10705AFDB18CF68CD89AAE7BB5FB48301F148129F516E7291D7B49E00CB54

Function 006E8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006E8BE8,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8FC5

DestroyWindow.USER32(?), ref: 006E8C81
KillTimer.USER32(00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00726973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 007269A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 007269B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000), ref: 007269D4
DeleteObject.GDI32(00000000), ref: 007269E6

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4bb26aec956ead845dbad22fb697a3635e9652425212de7769618bfd86d23a28
Instruction ID: c532157a4ffe608edce663264216bfb64cc7f2faa5811376aa32e0b3253d1f69
Opcode Fuzzy Hash: 4bb26aec956ead845dbad22fb697a3635e9652425212de7769618bfd86d23a28
Instruction Fuzzy Hash: E861AF30003790DFDB229F16D94872677F2FB82712F64851DE0869B660CB79B981CF98

Function 006E9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

GetSysColor.USER32(0000000F), ref: 006E9862

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f2cb288920d473719dd114cdb5f38dd60a17ceecf1f6f24acf7a6f9c6bf5cb41
Instruction ID: f2ec25cf4292dc54dc20e237437823fe99ca42be3dae8a77c56f510eeffe5df2
Opcode Fuzzy Hash: f2cb288920d473719dd114cdb5f38dd60a17ceecf1f6f24acf7a6f9c6bf5cb41
Instruction Fuzzy Hash: 8B41E2311017949FDB255F399C84BBA3B66AF06330F248A05F9A28B2F2D3749C42DB21

Function 00708D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.o, xrefs: 0070903A, 00708FD0, 00708FF2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: .o
API String ID: 0-1957372423
Opcode ID: a2d2d4247ac27b2bcf4d84df3ef3fe38d0109192b34bf9c5af5081b4b5290163
Instruction ID: 828c8c3f5b6c32db5ec654f076e1baca557b93afdc6cd4675d5c4b882d78edf1
Opcode Fuzzy Hash: a2d2d4247ac27b2bcf4d84df3ef3fe38d0109192b34bf9c5af5081b4b5290163
Instruction Fuzzy Hash: E3C1F174A0424AEFDB51DFA8C844BADBBF1AF49310F044299F654AB3D3C7389941CB61

Function 007396E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0071F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00739717
LoadStringW.USER32(00000000,?,0071F7F8,00000001), ref: 00739720

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0071F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00739742
LoadStringW.USER32(00000000,?,0071F7F8,00000001), ref: 00739745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00739866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0073984A
Line %d (File "%s"):, xrefs: 0073978F
Line %d:, xrefs: 007397A0
Error: , xrefs: 0073981D
^ ERROR, xrefs: 007397FB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: a0b434aca8f55dad4b28e0eeab1aed15579c73b28106b53d5bff374f8aea8f2d
Instruction ID: b73178ec05fd28a1bbcd66298862a916ee90a2b44c65ef12ab536a63cca4b8ad
Opcode Fuzzy Hash: a0b434aca8f55dad4b28e0eeab1aed15579c73b28106b53d5bff374f8aea8f2d
Instruction Fuzzy Hash: EB416F72D00219AADF44EBE0DE86DEE7379AF55740F10012AF60172292EB796F48CB75

Function 007306DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007307A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007307BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007307DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00730804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0073082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00730837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0073083C

Strings

\CLSID, xrefs: 00730724
SOFTWARE\Classes\, xrefs: 0073070E
\IPC$, xrefs: 00730784

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: ce43b72e09e6513090f05cd4315410f2b2f176549ced7d58ffa8b4fc0e309fd6
Instruction ID: 95c8acfcb59d74591375d26b5b1ddc976a2b038311719d0d3ca05f91431dd805
Opcode Fuzzy Hash: ce43b72e09e6513090f05cd4315410f2b2f176549ced7d58ffa8b4fc0e309fd6
Instruction Fuzzy Hash: 4E413872C10229ABDF15EBA4DC95CFDB779FF04350F04412AE901A32A1EB74AE04CBA4

Function 00753C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00753C5C
CoInitialize.OLE32(00000000), ref: 00753C8A
CoUninitialize.OLE32 ref: 00753C94
_wcslen.LIBCMT ref: 00753D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00753DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00753ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00753F0E
CoGetObject.OLE32(?,00000000,0076FB98,?), ref: 00753F2D
SetErrorMode.KERNEL32(00000000), ref: 00753F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00753FC4
VariantClear.OLEAUT32(?), ref: 00753FD8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 1ee407a23cb2d8df8c45d521919288e2c7b5a920656552f23e890d2d55d3a0fc
Instruction ID: 841770becafaa3893e06454ff6e696ba423a71e296c377707055a0e028d4a502
Opcode Fuzzy Hash: 1ee407a23cb2d8df8c45d521919288e2c7b5a920656552f23e890d2d55d3a0fc
Instruction Fuzzy Hash: B0C135716083059FD700DF64C88496BB7E9FF89785F00491DF98A9B260DBB5ED09CB62

Function 00747A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00747AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00747B8F
SHGetDesktopFolder.SHELL32(?), ref: 00747BA3
CoCreateInstance.OLE32(0076FD08,00000000,00000001,00796E6C,?), ref: 00747BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00747C74
CoTaskMemFree.OLE32(?,?), ref: 00747CCC
SHBrowseForFolderW.SHELL32(?), ref: 00747D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00747D7A
CoTaskMemFree.OLE32(00000000), ref: 00747D81
CoTaskMemFree.OLE32(00000000), ref: 00747DD6
CoUninitialize.OLE32 ref: 00747DDC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: b0855cfa8efa3787cdb3ecad2c2a4e616d270f264d02e70b5f8d3a3c159b1002
Instruction ID: 88fa4f46b2ed3f8bcd1c0b43ce7eeebb851591999076f28b77f8412965df9cd9
Opcode Fuzzy Hash: b0855cfa8efa3787cdb3ecad2c2a4e616d270f264d02e70b5f8d3a3c159b1002
Instruction Fuzzy Hash: 0DC12B75A04209AFCB14DFA4C884DAEBBF9FF48314B148499E81A9B361DB34ED45CF94

Function 0076541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00765504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00765515
CharNextW.USER32(00000158), ref: 00765544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00765585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0076559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007655AC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a9f19b519fba1ca7e1668433fffe26b91a0a4dee532c32914e6578a40c3d989e
Instruction ID: a9d3765b25db9d9cb9c25acf3f0b136b4d4e2724887bcd4f0457ca8e471b50d3
Opcode Fuzzy Hash: a9f19b519fba1ca7e1668433fffe26b91a0a4dee532c32914e6578a40c3d989e
Instruction Fuzzy Hash: FB618E30900609EFDF118F64CC84DFE7BB9EB05724F108185F967A6291DB7C9A80EB60

Function 0072FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0072FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0072FB08
VariantInit.OLEAUT32(?), ref: 0072FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0072FB3A
VariantCopy.OLEAUT32(?,?), ref: 0072FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0072FBA1
VariantClear.OLEAUT32(?), ref: 0072FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0072FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072FBCC
VariantClear.OLEAUT32(?), ref: 0072FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072FBE9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 087bfa131f44d690eacc3a97a6ded732074b4658513fc3f214a4300d00ee15d7
Instruction ID: 510550fcb4b1984d36b7978bfcc8d2588bb2ad7a7bbf485244397592e94b6b2f
Opcode Fuzzy Hash: 087bfa131f44d690eacc3a97a6ded732074b4658513fc3f214a4300d00ee15d7
Instruction Fuzzy Hash: 26418E75A00269DFCB01DF64D8589AEBFB9EF08354F00C039E946A7261CB78A945CFA4

Function 00739C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00739CA1
GetAsyncKeyState.USER32(000000A0), ref: 00739D22
GetKeyState.USER32(000000A0), ref: 00739D3D
GetAsyncKeyState.USER32(000000A1), ref: 00739D57
GetKeyState.USER32(000000A1), ref: 00739D6C
GetAsyncKeyState.USER32(00000011), ref: 00739D84
GetKeyState.USER32(00000011), ref: 00739D96
GetAsyncKeyState.USER32(00000012), ref: 00739DAE
GetKeyState.USER32(00000012), ref: 00739DC0
GetAsyncKeyState.USER32(0000005B), ref: 00739DD8
GetKeyState.USER32(0000005B), ref: 00739DEA

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: fb361379aad0776e414fa5a19382949fe7b27a2882a2f76306813bcc5f1e7414
Instruction ID: 6d32a2f2b0f9efbf5ff9596b3831d434f2d91112b2025aa6cb171632a572426d
Opcode Fuzzy Hash: fb361379aad0776e414fa5a19382949fe7b27a2882a2f76306813bcc5f1e7414
Instruction Fuzzy Hash: BC41B5346047CA69FF719674C8053B6BEA06F11344F08805ADBC7566C3EBED99D8CBA2

Function 0075055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007505BC
inet_addr.WSOCK32(?), ref: 0075061C
gethostbyname.WSOCK32(?), ref: 00750628
IcmpCreateFile.IPHLPAPI ref: 00750636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007506C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007506E5
IcmpCloseHandle.IPHLPAPI(?), ref: 007507B9
WSACleanup.WSOCK32 ref: 007507BF

Strings

Ping, xrefs: 00750676

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: dc47b272685abdf6b0c64e8906a9b105eb58a63451a47c123ff960be20e6fe1c
Instruction ID: feb911616852a11f65a144d2db004482e7efd395c37ba8469346978a71fce0e8
Opcode Fuzzy Hash: dc47b272685abdf6b0c64e8906a9b105eb58a63451a47c123ff960be20e6fe1c
Instruction Fuzzy Hash: 7B918D755042019FD720CF15C488F5ABBE1EF48318F1489A9E86A8B7A2D7B8ED49CFD1

Function 00758CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00758CF3

Part of subcall function 00738E54: _wcslen.LIBCMT ref: 00738E77

_wcslen.LIBCMT ref: 00758D4E
_wcslen.LIBCMT ref: 00758D9C
_wcslen.LIBCMT ref: 00758DDC
_wcslen.LIBCMT ref: 00758E6E

Strings

stdcall, xrefs: 00758DD6, 00758DDB
winapi, xrefs: 00758D96, 00758D9B
none, xrefs: 00758E65, 00758E6A
cdecl, xrefs: 00758D48, 00758D4D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 5c643f9dc279783118a9dc3de1e2d3a1fd070a837c8a66843c51095ff92acf33
Instruction ID: a7b34931148121a93e99812c5ecf47b64bce4b8377e0ade6bc4057e9b4f34c78
Opcode Fuzzy Hash: 5c643f9dc279783118a9dc3de1e2d3a1fd070a837c8a66843c51095ff92acf33
Instruction Fuzzy Hash: 8751AE31A001169BCB94DF68C8419FEB3B2AF69721B204229E866F7284DFB9DD44C791

Function 0075372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00753774
CoUninitialize.OLE32 ref: 0075377F
CoCreateInstance.OLE32(?,00000000,00000017,0076FB78,?), ref: 007537D9
IIDFromString.OLE32(?,?), ref: 0075384C
VariantInit.OLEAUT32(?), ref: 007538E4
VariantClear.OLEAUT32(?), ref: 00753936

Strings

NULL Pointer assignment, xrefs: 0075381E
Failed to create object, xrefs: 007537E4, 0075389A
Invalid parameter, xrefs: 00753865

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 100fc77af6ec5ecfa0860f0edc32f883d9909ec2bcaa80e79513665ad4ca3daf
Instruction ID: 463e6d4598e71809c39e55dd969ee3055a8d7088d5a7e92745fe8f3fa9fb499c
Opcode Fuzzy Hash: 100fc77af6ec5ecfa0860f0edc32f883d9909ec2bcaa80e79513665ad4ca3daf
Instruction Fuzzy Hash: 1861C4B06083019FD315DF54C889FAABBE4EF48755F00490DF985972A1D7B8EE48CBA6

Function 00743388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007433CF

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007433F0

Strings

"%s" (%d) : ==> %s:, xrefs: 00743522
Line %d (File "%s"):, xrefs: 00743443, 0074345C
^ ERROR , xrefs: 0074349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00743504
Incorrect parameters to object property !, xrefs: 007434AB
Error: , xrefs: 007434D1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 4d5f1c91b362c3c5f27dc170850a04f9fce42670f2beb50ddbc39bf69c709e38
Instruction ID: a179a63fe67848d848bab646894733614720871dcb4199b9bc08650f7e9364d0
Opcode Fuzzy Hash: 4d5f1c91b362c3c5f27dc170850a04f9fce42670f2beb50ddbc39bf69c709e38
Instruction Fuzzy Hash: 3E51F471D00219AAEF15EBE0DD46EEEB779EF04340F10416AF10572252EB392F58DB65

Function 0073B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0073B5FC
_wcslen.LIBCMT ref: 0073B608
_wcslen.LIBCMT ref: 0073B64D
_wcslen.LIBCMT ref: 0073B68C
_wcslen.LIBCMT ref: 0073B6C7

Strings

EXISTS, xrefs: 0073B686, 0073B68B
APPEND, xrefs: 0073B6C1, 0073B6C6
KEYS, xrefs: 0073B647, 0073B64C
REMOVE, xrefs: 0073B602, 0073B607

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 5aa0e9982f3e774866ad0446cf34bef2aa17330b8e9f8bbb5af3296760146114
Instruction ID: bcff0bc1f5e9aa95ec3128bd82eed675067377857034562d704d549b8473f148
Opcode Fuzzy Hash: 5aa0e9982f3e774866ad0446cf34bef2aa17330b8e9f8bbb5af3296760146114
Instruction Fuzzy Hash: 27410632A01026DBDB205F7DC8925BE77A5AFA1754F24422AE621DB287E739CD81C790

Function 00745393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007453A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00745416
GetLastError.KERNEL32 ref: 00745420
SetErrorMode.KERNEL32(00000000,READY), ref: 007454A7

Strings

NOTREADY, xrefs: 0074544B
INVALID, xrefs: 00745459
UNKNOWN, xrefs: 00745444
READY, xrefs: 00745460, 00745468
READONLY, xrefs: 00745452

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9f732e74d15cd74c6a5dc1c8ca7b74b3e253f004fedcd62343a2a524719d2b2f
Instruction ID: 1cc20de00ed15d343bb3e455532a33f1a24b0991f87a91e164da613ff53cf3b2
Opcode Fuzzy Hash: 9f732e74d15cd74c6a5dc1c8ca7b74b3e253f004fedcd62343a2a524719d2b2f
Instruction Fuzzy Hash: 4231A075A006449FCB11DF6CD484AAA7BB4EF05305F148169E806CF393DB79DD82CB91

Function 00763C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00763C79
SetMenu.USER32(?,00000000), ref: 00763C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00763D10
IsMenu.USER32(?), ref: 00763D24
CreatePopupMenu.USER32 ref: 00763D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00763D5B
DrawMenuBar.USER32 ref: 00763D63

Strings

F, xrefs: 00763D4E
0, xrefs: 00763C54

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 549217a9828e82331cc62d4842b9258a51f048a7693b53ec5a57310431a70f22
Instruction ID: 27af17df993fd9e34caa83d4de14066fea2ee4d35bbf643e0bfa4782297f9842
Opcode Fuzzy Hash: 549217a9828e82331cc62d4842b9258a51f048a7693b53ec5a57310431a70f22
Instruction Fuzzy Hash: B7415679A01209AFDB14CFA4DC84AAA7BB5FF49351F144029FD47A7360D778AA10CF98

Function 00731EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00731F64
GetDlgCtrlID.USER32 ref: 00731F6F
GetParent.USER32 ref: 00731F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00731F8E
GetDlgCtrlID.USER32(?), ref: 00731F97
GetParent.USER32(?), ref: 00731FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00731FAE

Strings

ListBox, xrefs: 00731F21
ComboBox, xrefs: 00731EEC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 70f30068dde8c1cff6d0949c3ce176704b6036765fe7eb5677a3c6515aa66a77
Instruction ID: 3f536b3b1dfb40ccdfbb00475503020ad0cd34d414a4604c9a059dbcec436ba2
Opcode Fuzzy Hash: 70f30068dde8c1cff6d0949c3ce176704b6036765fe7eb5677a3c6515aa66a77
Instruction Fuzzy Hash: 8521B074E00215BBDF05AFA0DC85DFEBBB9AF05310F00459AF96267292CB7859049B78

Function 00763A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00763A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00763AA0
GetWindowLongW.USER32(?,000000F0), ref: 00763AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00763AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00763B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00763BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00763BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00763BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00763BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00763C13

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 06fecd392efad6acfc20318499c4c7634008b34adbf417c5e8e45a513dab8665
Instruction ID: 585b4753c3fc8015170728b2b2a26f47687aceef2413ce54bc42cf5aedaaa587
Opcode Fuzzy Hash: 06fecd392efad6acfc20318499c4c7634008b34adbf417c5e8e45a513dab8665
Instruction Fuzzy Hash: 21618C75900248AFDB11DFA8CC81EEE77B8EF49700F104199FA16E72A1C778AE45DB64

Function 0073B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0073B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B165
GetWindowThreadProcessId.USER32(00000000), ref: 0073B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0073B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0073A1E1,?,00000001), ref: 0073B21D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8bc8d425edd1d41f61a2257762b6e352dcb323e8b8c58ef0a1e890fa13140902
Instruction ID: 7220ce584162416e83be6269efb496293819f43cae6a7950a89e792d5cb05483
Opcode Fuzzy Hash: 8bc8d425edd1d41f61a2257762b6e352dcb323e8b8c58ef0a1e890fa13140902
Instruction Fuzzy Hash: FE317C75500308BFEB119F64DC49B7FBBAABB92311F10C115FA06DA192D7BC9A408F68

Function 00702C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00702C94

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 00702CA0
_free.LIBCMT ref: 00702CAB
_free.LIBCMT ref: 00702CB6
_free.LIBCMT ref: 00702CC1
_free.LIBCMT ref: 00702CCC
_free.LIBCMT ref: 00702CD7
_free.LIBCMT ref: 00702CE2
_free.LIBCMT ref: 00702CED
_free.LIBCMT ref: 00702CFB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6935c87624f14a5b7efff48327b01aa265184bce4f8e246b693c8540741c1431
Instruction ID: 43a0959efaac3c4b7e5f12627f2c72cc55203aa6845d242f33339e1b85032b3b
Opcode Fuzzy Hash: 6935c87624f14a5b7efff48327b01aa265184bce4f8e246b693c8540741c1431
Instruction Fuzzy Hash: 00119676110108EFCB02EF54D84ACDD3BA9FF05350F6146A5F9486B272D635FA519F90

Function 006D1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 006D1459
OleUninitialize.OLE32(?,00000000), ref: 006D14F8
UnregisterHotKey.USER32(?), ref: 006D16DD
DestroyWindow.USER32(?), ref: 007124B9
FreeLibrary.KERNEL32(?), ref: 0071251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0071254B

Strings

close all, xrefs: 006D1454

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4542dc0b85bcd79e911350f0b927132c1db83d4b742749c9cede213ce090a67e
Instruction ID: c17395baa87b00ac904a9ad7e1a1b948bdfc85369b5e74a749bd6d1861ab054b
Opcode Fuzzy Hash: 4542dc0b85bcd79e911350f0b927132c1db83d4b742749c9cede213ce090a67e
Instruction Fuzzy Hash: 4FD16D31B01212DFCB19EF19C495A69F7A2BF05700F1441AEE84A6B3A2DB74AD63CF54

Function 00747DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00747FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00747FC1
GetFileAttributesW.KERNEL32(?), ref: 00747FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00748005
SetCurrentDirectoryW.KERNEL32(?), ref: 00748017
SetCurrentDirectoryW.KERNEL32(?), ref: 00748060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007480B0

Strings

*.*, xrefs: 00748066

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 9c01faa8c53c17c54e04815e99b3da0bf4fd2e602b47181f321d82f1d74e224d
Instruction ID: f83278e341b416f2564c520f03558f0fa2fe61f9545a79924b1ce55110d14b4d
Opcode Fuzzy Hash: 9c01faa8c53c17c54e04815e99b3da0bf4fd2e602b47181f321d82f1d74e224d
Instruction Fuzzy Hash: 7181AF725082559BCB68EF14C8849AEB3E9BF88310F544D5EF885C7260EB39DD49CB92

Function 006D5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 006D5C7A

Part of subcall function 006D5D0A: GetClientRect.USER32(?,?), ref: 006D5D30
Part of subcall function 006D5D0A: GetWindowRect.USER32(?,?), ref: 006D5D71
Part of subcall function 006D5D0A: ScreenToClient.USER32(?,?), ref: 006D5D99

GetDC.USER32 ref: 007146F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00714708
SelectObject.GDI32(00000000,00000000), ref: 00714716
SelectObject.GDI32(00000000,00000000), ref: 0071472B
ReleaseDC.USER32(?,00000000), ref: 00714733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007147C4

Strings

U, xrefs: 00714693

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bd4fbbfd26edb954e1b415a4186b5d3f5323206b42ef5421f56b6b6277849dca
Instruction ID: c93a29ae5c24e2397aebaa55694c1800c22f43e1d9e75eaa266f2639d9a167bf
Opcode Fuzzy Hash: bd4fbbfd26edb954e1b415a4186b5d3f5323206b42ef5421f56b6b6277849dca
Instruction Fuzzy Hash: A371E131900205DFCF218F68C984AFA3BB6FF4A365F14426AED565A2E6C7399C81DF50

Function 0074359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007435E4

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

LoadStringW.USER32(007A2390,?,00000FFF,?), ref: 0074360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00743742
Line %d (File "%s"):, xrefs: 0074366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00743724
Error: , xrefs: 007436EF
^ ERROR, xrefs: 007436C9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: ff30329075effff287e0f063cac1a140231ec31b7f70b66b10eaf0dfd9c83950
Instruction ID: c37b5d2820cea2601d1c3ef607c6a45cb201f7257c41707420e4e929b4182f98
Opcode Fuzzy Hash: ff30329075effff287e0f063cac1a140231ec31b7f70b66b10eaf0dfd9c83950
Instruction Fuzzy Hash: C1517171D00259BADF15EBA0DC46EEDBB39AF04300F14412AF505722A1DB751B98DFA5

Function 0074C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0074C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0074C2CA
GetLastError.KERNEL32 ref: 0074C322
SetEvent.KERNEL32(?), ref: 0074C336
InternetCloseHandle.WININET(00000000), ref: 0074C341

Strings

, xrefs: 0074C2BB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 0c5acad495dd7ddf09b2099c0a44ef209630204c09c445ec2434493035c1d27e
Instruction ID: b6dc6416ff79f7a39856ffcb307c316dc0c164a0353473d73fd3f198d18aef88
Opcode Fuzzy Hash: 0c5acad495dd7ddf09b2099c0a44ef209630204c09c445ec2434493035c1d27e
Instruction Fuzzy Hash: 49317CB1601308AFD7629FA5CC88ABB7BFCEB49744F14851EF486D2210DB78DD049B65

Function 0073989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00713AAF,?,?,Bad directive syntax error,0076CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 007398BC
LoadStringW.USER32(00000000,?,00713AAF,?), ref: 007398C3

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00739987

Strings

Error: , xrefs: 00739955
%s (%d) : ==> %s.: %s %s, xrefs: 007398F1
Line %d (File "%s"):, xrefs: 0073992D
Line %d:, xrefs: 00739912
., xrefs: 0073996D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: a9e269a17ab2d6e4b35a7943a4fb53368661db7443857effa26837f5dc1a28be
Instruction ID: 7928cdc2cf152a5156d6d48401b141ff6506439a16a4085b603d4843ce78d35e
Opcode Fuzzy Hash: a9e269a17ab2d6e4b35a7943a4fb53368661db7443857effa26837f5dc1a28be
Instruction Fuzzy Hash: D521B471D0025EEBDF15AF90CC06EED7736FF18300F04441AF515661A2DB79A628DB25

Function 0073209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007320AB
GetClassNameW.USER32(00000000,?,00000100), ref: 007320C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0073214D

Strings

smallicons, xrefs: 00732115
SHELLDLL_DefView, xrefs: 007320CC
largeicons, xrefs: 007320E1
details, xrefs: 007320FB
list, xrefs: 0073212F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: f107ac6b18a28d8a41e2f7b7e177f5c65d3bf0f582e46efe92c045a524f06f60
Instruction ID: 8dfd014febe5f36b1f5b6f436b1fbff5c0959fcdb5cac0f76a40a8e2bfdff386
Opcode Fuzzy Hash: f107ac6b18a28d8a41e2f7b7e177f5c65d3bf0f582e46efe92c045a524f06f60
Instruction Fuzzy Hash: 8A11E3B668871EB9FA022224ED06DB7379CCB04324F20015AFB05A50E7FEA969035618

Function 0070CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0070CEB7
_free.LIBCMT ref: 0070CF22
_free.LIBCMT ref: 0070CF48
_free.LIBCMT ref: 0070CF71
_free.LIBCMT ref: 0070CFA9
_free.LIBCMT ref: 0070CFDA
_free.LIBCMT ref: 0070D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0070D09C
_free.LIBCMT ref: 0070D0B5

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 98eaf1aa8db762972f091f95f26b90050fa767fb2b08d1bb0985a8c7704c0b8d
Instruction ID: 2fc5c6819e06a99f8a3af5397176a69a7ca00f161ca8030ff2e4312c7df0eaa8
Opcode Fuzzy Hash: 98eaf1aa8db762972f091f95f26b90050fa767fb2b08d1bb0985a8c7704c0b8d
Instruction Fuzzy Hash: 78614973A04302EFDB22AFB4D88966E7BE5AF05310F14476DF945A72C2D63DAD018791

Function 007650D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00765186
ShowWindow.USER32(?,00000000), ref: 007651C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 007651CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 007651D1

Part of subcall function 00766FBA: DeleteObject.GDI32(00000000), ref: 00766FE6

GetWindowLongW.USER32(?,000000F0), ref: 0076520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0076521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0076524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00765287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00765296

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 623fea6e7e9f8b648037a5c459cf90159b9ed8ee681cd02ee3d60994a4558418
Instruction ID: 8bdb8b99762e30df70c46ed8709839f7201a762aca9e505ea10b152bf054ec04
Opcode Fuzzy Hash: 623fea6e7e9f8b648037a5c459cf90159b9ed8ee681cd02ee3d60994a4558418
Instruction Fuzzy Hash: 0A519270A41A08FEEF249F28CC59BD93B65FB06321F148111FD17962E0C3BDA990EB55

Function 006E8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00726890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 007268A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007268B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 007268D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007268F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,006E8874,00000000,00000000,00000000,000000FF,00000000), ref: 00726901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0072691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,006E8874,00000000,00000000,00000000,000000FF,00000000), ref: 0072692D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d6b9c59ff612a45e63d3e0f52d23b6f980a4598fa293e220072b0de570e12e60
Instruction ID: a5536db9ac273d6ff36c92aff29d4a13d05fd7370b0bb7d3c9081560d95670b3
Opcode Fuzzy Hash: d6b9c59ff612a45e63d3e0f52d23b6f980a4598fa293e220072b0de570e12e60
Instruction Fuzzy Hash: BE51A870600349EFDB20CF25CC95BAA7BB6EF88350F108519F946972A0DBB8E991DB50

Function 0074C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0074C182
GetLastError.KERNEL32 ref: 0074C195
SetEvent.KERNEL32(?), ref: 0074C1A9

Part of subcall function 0074C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0074C272
Part of subcall function 0074C253: GetLastError.KERNEL32 ref: 0074C322
Part of subcall function 0074C253: SetEvent.KERNEL32(?), ref: 0074C336
Part of subcall function 0074C253: InternetCloseHandle.WININET(00000000), ref: 0074C341

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 0680e363e104d739e0b94aee18874776dc03688f1318fa73f1858981511b0b0e
Instruction ID: 98ef851e4a431c5ce2d4ef5473934a91c362f7f8047d6e0182cb193791330184
Opcode Fuzzy Hash: 0680e363e104d739e0b94aee18874776dc03688f1318fa73f1858981511b0b0e
Instruction Fuzzy Hash: DD31AF71202745EFDB629FB5DC04A76BBF8FF18300B04842DF99686620D7B9E8149B60

Function 007325A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 007325BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007325DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 007325DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 007325E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00732601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00732605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0073260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00732623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00732627

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e9c4d3b46787181fda0e4f9fc104202ad761656a1e39a24fe3e88b9f6e2d7599
Instruction ID: 58749824395ef0a3cd213885e9637fcb0f503eef39c5a056950e5e8f64cbda7a
Opcode Fuzzy Hash: e9c4d3b46787181fda0e4f9fc104202ad761656a1e39a24fe3e88b9f6e2d7599
Instruction Fuzzy Hash: 0901B170390314BBFB206768DC8FF693E59DB4AB12F104041F359AE0E2C9EA28458A6D

Function 00731803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00731449,?,?,00000000), ref: 0073180C
HeapAlloc.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 00731813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00731449,?,?,00000000), ref: 00731828
GetCurrentProcess.KERNEL32(?,00000000,?,00731449,?,?,00000000), ref: 00731830
DuplicateHandle.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 00731833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00731449,?,?,00000000), ref: 00731843
GetCurrentProcess.KERNEL32(00731449,00000000,?,00731449,?,?,00000000), ref: 0073184B
DuplicateHandle.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 0073184E
CreateThread.KERNEL32(00000000,00000000,00731874,00000000,00000000,00000000), ref: 00731868

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bba34851ef44c44349ff529f565cf02bcadf1eb55fc13f5368194b4992b6db62
Instruction ID: 7af4586682d79fdd02922e4202f9aea89e0a75d119d406d5ee64f6d68ef4e480
Opcode Fuzzy Hash: bba34851ef44c44349ff529f565cf02bcadf1eb55fc13f5368194b4992b6db62
Instruction Fuzzy Hash: DE01BFB5240348BFE711AB65DC4EF673B6CEB8AB11F418411FA45DB191C6B59C00CB34

Function 00703E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00703F0B
__alldvrm.LIBCMT ref: 0070410C
__alldvrm.LIBCMT ref: 0070412E

Strings

}}o, xrefs: 00703E8A
}}o, xrefs: 00703E96, 00703EF1, 00703F0A, 00704090
}}o, xrefs: 007040CD

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}o$}}o$}}o
API String ID: 1036877536-3068425625
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 6d6b0cdce89d9cdacfbac46691bbb7508128e8515eaa22b07f8e63b81798b16f
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: C5A126B2E04286DFDB15CF18C8917AEBBE5EF61350F1442ADE695AB2C2C23C9981C750

Function 0075A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0073D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Part of subcall function 0073D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Part of subcall function 0073D4DC: CloseHandle.KERNEL32(00000000), ref: 0073D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075A16D
GetLastError.KERNEL32 ref: 0075A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0075A268
GetLastError.KERNEL32(00000000), ref: 0075A273
CloseHandle.KERNEL32(00000000), ref: 0075A2C4

Strings

SeDebugPrivilege, xrefs: 0075A18F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: a113764b83badd6d8d7ccc8dffd7bd66d3a5f4dd373e8a4efb2b348a3950ccb6
Instruction ID: 2d5076510f2ac23343b7d3232febcbdc6b508e1886fbf137faa63d9ed84abe1f
Opcode Fuzzy Hash: a113764b83badd6d8d7ccc8dffd7bd66d3a5f4dd373e8a4efb2b348a3950ccb6
Instruction Fuzzy Hash: E761B171204242AFD710DF19C495F65BBE1BF84318F14859CE8568B7A3C7BAEC49CB92

Function 00763886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00763925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0076393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00763954
_wcslen.LIBCMT ref: 00763999
SendMessageW.USER32(?,00001057,00000000,?), ref: 007639C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007639F4

Strings

SysListView32, xrefs: 007638F7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 5c7dcfc4952fdc0402e8fbca96f5d5dd2ce03124b1360d96417510374086a4bd
Instruction ID: b19383b339d33875891d6c9d52597726938d4ef7b59656340d169247639685a7
Opcode Fuzzy Hash: 5c7dcfc4952fdc0402e8fbca96f5d5dd2ce03124b1360d96417510374086a4bd
Instruction Fuzzy Hash: 6441D871A00319ABEF219F64CC49FEA77A9EF08354F10016AF955E7281D7B99D80CB94

Function 0073BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0073BCFD
IsMenu.USER32(00000000), ref: 0073BD1D
CreatePopupMenu.USER32 ref: 0073BD53
GetMenuItemCount.USER32(01547758), ref: 0073BDA4
InsertMenuItemW.USER32(01547758,?,00000001,00000030), ref: 0073BDCC

Strings

0, xrefs: 0073BCA8
2, xrefs: 0073BD37

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 0323591d10505c7d26d13da446df9f309b7e2fbf9c4bc6e12816507217e2b0c8
Instruction ID: 4e9dfb1b1616064414aab30670b2a3bad5e1b172d9c8b18e9ec3d228bc5b5a39
Opcode Fuzzy Hash: 0323591d10505c7d26d13da446df9f309b7e2fbf9c4bc6e12816507217e2b0c8
Instruction Fuzzy Hash: EA51D270B10309DBEF11DFA8D888BAEBBF4BF45314F248119E642D7292D778A940CB61

Function 006F2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006F2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 006F2D53
_ValidateLocalCookies.LIBCMT ref: 006F2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 006F2E0C
_ValidateLocalCookies.LIBCMT ref: 006F2E61

Strings

&Ho, xrefs: 006F2DFE, 006F2E07, 006F2E18
csm, xrefs: 006F2DF6

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &Ho$csm
API String ID: 1170836740-2077702024
Opcode ID: f6a94c6f19235291afb56e7521eb9cc2da098255eacefc04e7aa7ffc6c5fd22d
Instruction ID: f703c9eea8bb3f9fb39bf99ab3fd6a378596394a0355c0b63e31ddac373f0123
Opcode Fuzzy Hash: f6a94c6f19235291afb56e7521eb9cc2da098255eacefc04e7aa7ffc6c5fd22d
Instruction Fuzzy Hash: F141A434A0021EABCF10DF68C855AEEBBB6BF45354F148155EA14AB392D7359A11CFD0

Function 0073C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0073C913

Strings

question, xrefs: 0073C8CC
stop, xrefs: 0073C8E4
info, xrefs: 0073C8B4
blank, xrefs: 0073C895
warning, xrefs: 0073C8FC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 08e135b5ef8f20f1f7049caa3c0956f4cb09f55a839453ff335c4f3606bd45b9
Instruction ID: 7719464671d4327051e223bf23474e459e5ed616b19606c50cd7e6a43706e579
Opcode Fuzzy Hash: 08e135b5ef8f20f1f7049caa3c0956f4cb09f55a839453ff335c4f3606bd45b9
Instruction Fuzzy Hash: D511EB3268930ABEBB029B55AC82DAB779CDF15754F11006EF500B6183EBAD7F005368

Function 0073DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0073DE42
gethostname.WSOCK32(?,00000100), ref: 0073DE5C
gethostbyname.WSOCK32(?), ref: 0073DE69
inet_ntoa.WSOCK32(?), ref: 0073DEAB
_strcat.LIBCMT ref: 0073DEB9
WSACleanup.WSOCK32 ref: 0073DEDE

Strings

0.0.0.0, xrefs: 0073DE87

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: f5f56b898b4aba595effc662cb00c370c549a28a4c364911ed5d64b5d22eade3
Instruction ID: 47582e3f54b2f678cd878244581fcd62bb9c3f5d277fc10f927240a2df53e890
Opcode Fuzzy Hash: f5f56b898b4aba595effc662cb00c370c549a28a4c364911ed5d64b5d22eade3
Instruction Fuzzy Hash: 71110A71904219AFEB316B20AC0ADFF7B6DDF10710F04016DF54596092EFB99E818A54

Function 0073ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0073ED2A
_wcslen.LIBCMT ref: 0073ED3B
_wcslen.LIBCMT ref: 0073ED79
_wcslen.LIBCMT ref: 0073EDAF
_wcslen.LIBCMT ref: 0073EDDF
_wcslen.LIBCMT ref: 0073EDEF
_wcslen.LIBCMT ref: 0073EE2B
_wcslen.LIBCMT ref: 0073EE5A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: e4b8644315091cb30925ac25193e0e5a6c09641022a926cd9cf728660350de70
Instruction ID: 953233d71ce4e2f53a67f8cd337d2b747e19839fe56707d770a17ad22f643e5b
Opcode Fuzzy Hash: e4b8644315091cb30925ac25193e0e5a6c09641022a926cd9cf728660350de70
Instruction Fuzzy Hash: 9D41B065D1021C75DB51EBB4C88A9DFB3AAAF45700F40846AF618E3162FB38E345C3E9

Function 006EF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 006EF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0072F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0072F454

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: c33650abf925a2f62fd7aca9c93ceeb5bed67d18ffd840974c4d266bf627fe3d
Instruction ID: 062bb6544e084ecf765a34ef74093c6220656b5b4e65e697ae4fde4e97b97505
Opcode Fuzzy Hash: c33650abf925a2f62fd7aca9c93ceeb5bed67d18ffd840974c4d266bf627fe3d
Instruction Fuzzy Hash: 8F412A302197C0BBC7399B2AD88877A7BA3AB46310F15843DF0C757663C679A881CB51

Function 00762D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00762D1B
GetDC.USER32(00000000), ref: 00762D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00762D2E
ReleaseDC.USER32(00000000,00000000), ref: 00762D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00762D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00762D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00765A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00762DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00762DE1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2eca772ffb24327bd19ee26f9e20a0da3daa88bd3f8c08ae26a0a95bf0d7b13c
Instruction ID: e59e62a9a3103ee56d2bdecc53e4818e11792e9de70ddbf83036de619ca0352e
Opcode Fuzzy Hash: 2eca772ffb24327bd19ee26f9e20a0da3daa88bd3f8c08ae26a0a95bf0d7b13c
Instruction Fuzzy Hash: F5319172201614BFEB154F50CC49FFB3BADEF09715F044055FE499A192C6B99C41CBA8

Function 00735622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00735637
_memcmp.LIBVCRUNTIME ref: 00735659
_memcmp.LIBVCRUNTIME ref: 00735671
_memcmp.LIBVCRUNTIME ref: 00735684
_memcmp.LIBVCRUNTIME ref: 0073569E
_memcmp.LIBVCRUNTIME ref: 007356B1
_memcmp.LIBVCRUNTIME ref: 007356C9
_memcmp.LIBVCRUNTIME ref: 007356E4

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f8a383b01382925de88b3a6bec6e558427d412a982814cdc32fd625fbda12b39
Instruction ID: a3821fdb972465b6239d3089ef810889410c7ee1e6a05f45d263ee81356c419d
Opcode Fuzzy Hash: f8a383b01382925de88b3a6bec6e558427d412a982814cdc32fd625fbda12b39
Instruction Fuzzy Hash: C92195F2644A19F7F21456209D93FBA235EAF217C4F840024FE059A586FB28ED10C2E9

Function 00754FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0075502E, 00755383
Not an Object type, xrefs: 00755007

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: b59f2b8d24d862db37b5439390327dff9ef549a256bd2ba96bd90e4ccbf89fdb
Instruction ID: c35b2652cbaf4d0dc1c6a0f84f1a077113bc1f6baf5f659c0d7a13d13f336851
Opcode Fuzzy Hash: b59f2b8d24d862db37b5439390327dff9ef549a256bd2ba96bd90e4ccbf89fdb
Instruction Fuzzy Hash: 7ED1D671A0060A9FDF10CFA8C891BEEB7B5BF48354F148069ED15AB281E7B4DD49CB90

Function 00711522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 007115CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00711651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007116E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 007116FB

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00711777
__freea.LIBCMT ref: 007117A2
__freea.LIBCMT ref: 007117AE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: aab147aaecb947bb0a71e2b8c7b8681f88a8f495e400caf70a91402220c61039
Instruction ID: d2d2d582cccc64d57dd6f074ab0d7af80b43fb83db76196ec2c143f09337c0c8
Opcode Fuzzy Hash: aab147aaecb947bb0a71e2b8c7b8681f88a8f495e400caf70a91402220c61039
Instruction Fuzzy Hash: 6191A571E102169ADB218E78CC45AEE7BB69F49710F984659EA01EF2C1DB3DDD80C760

Function 00754523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00754648
VariantInit.OLEAUT32(?), ref: 00754749
VariantClear.OLEAUT32(?), ref: 00754753
VariantClear.OLEAUT32(?), ref: 007547B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0075472C
Null Object assignment in FOR..IN loop, xrefs: 007545D8, 00754706, 007547BE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: a816421ceb8652fd13ce2d21c9265babff1bb9ece6676884ec783f9e8619c521
Instruction ID: 4312fbc68a478a746e81e2f87e755001f8efa236fbb38830d26e8f835f4e9a57
Opcode Fuzzy Hash: a816421ceb8652fd13ce2d21c9265babff1bb9ece6676884ec783f9e8619c521
Instruction Fuzzy Hash: EE91A471A00219ABDF24CFA5CC44FEE7BB8EF45715F108559F905AB280D7B89989CFA0

Function 00741187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0074125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00741284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 007412A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007412D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0074135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007413C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00741430

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: f0e60700998aeb37fe3f53f396b685972e67b6c8dd360d7433497c09dfbd91d3
Instruction ID: a2317020f907cf3f7b95684436d4509797e82e16ea7a1fde8206d1cb2cd6df47
Opcode Fuzzy Hash: f0e60700998aeb37fe3f53f396b685972e67b6c8dd360d7433497c09dfbd91d3
Instruction Fuzzy Hash: D391F475A00219DFDB01EF98C884BBE77B5FF44324F548029EA51EB291D7BCA981CB94

Function 006E948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 16c06dcb0ebd52a45c32db97c2e5b955270900eabe12ec971a41447f058989b0
Instruction ID: 19f580b0c245ad83f8e8d802c037397c12a892cf10e1bf49b0ef69849a9c9685
Opcode Fuzzy Hash: 16c06dcb0ebd52a45c32db97c2e5b955270900eabe12ec971a41447f058989b0
Instruction Fuzzy Hash: AA914671D01259EFCB15CFAACC84AEEBBB9FF48320F148049E516B7251D378A942CB60

Function 00753947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0075396B
CharUpperBuffW.USER32(?,?), ref: 00753A7A
_wcslen.LIBCMT ref: 00753A8A
VariantClear.OLEAUT32(?), ref: 00753C1F

Part of subcall function 00740CDF: VariantInit.OLEAUT32(00000000), ref: 00740D1F
Part of subcall function 00740CDF: VariantCopy.OLEAUT32(?,?), ref: 00740D28
Part of subcall function 00740CDF: VariantClear.OLEAUT32(?), ref: 00740D34

Strings

AUTOIT.ERROR, xrefs: 00753A80, 00753A85
Incorrect Parameter format, xrefs: 007539A6, 00753BA1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 35f7f9147b0e9dc9dab917e67a47352a57e077566294706f00bf17d3221d5ec4
Instruction ID: 5d284730851b6570eed9cfbeeef0dfbfff5b826238345ecd082dbe18555951bd
Opcode Fuzzy Hash: 35f7f9147b0e9dc9dab917e67a47352a57e077566294706f00bf17d3221d5ec4
Instruction Fuzzy Hash: B491AE746083059FC704DF24C48086AB7E5FF88355F04892EF8899B361DB75EE09CB92

Function 00754BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0073000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?,?,0073035E), ref: 0073002B
Part of subcall function 0073000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730046
Part of subcall function 0073000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730054
Part of subcall function 0073000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?), ref: 00730064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00754C51
_wcslen.LIBCMT ref: 00754D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00754DCF
CoTaskMemFree.OLE32(?), ref: 00754DDA

Strings

NULL Pointer assignment, xrefs: 00754E23, 00754E52

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 8b1c8e9490ddc2d60c37645ed2d40e2a8827f06902028f16f7fc78fa5ab2ac12
Instruction ID: d78b41c4609d6784e53fbdf8502645fcea7b105df21da408e2e9b59d9c0b5954
Opcode Fuzzy Hash: 8b1c8e9490ddc2d60c37645ed2d40e2a8827f06902028f16f7fc78fa5ab2ac12
Instruction Fuzzy Hash: F1912671D0021DEFDF14DFA4D891AEEB7B9BF08314F10856AE915A7241DB749A48CFA0

Function 007620FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00762183
GetMenuItemCount.USER32(00000000), ref: 007621B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007621DD
_wcslen.LIBCMT ref: 00762213
GetMenuItemID.USER32(?,?), ref: 0076224D
GetSubMenu.USER32(?,?), ref: 0076225B

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007622E3

Part of subcall function 0073E97B: Sleep.KERNELBASE ref: 0073E9F3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: a2702e4b087ad8ff41dc6e1b2aa1380f8b10231e777d2dd71c0d6f828efd3eed
Instruction ID: efdd7c7be3d1e1bba6bee4cdc73c57dc5c410da23ee467c2bff943000afaf806
Opcode Fuzzy Hash: a2702e4b087ad8ff41dc6e1b2aa1380f8b10231e777d2dd71c0d6f828efd3eed
Instruction Fuzzy Hash: 02719F35E00605AFCB54DF64C845AAEB7F6FF88320F158459E817EB352DB78AD428B90

Function 00767E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(015477A8), ref: 00767F37
IsWindowEnabled.USER32(015477A8), ref: 00767F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0076801E
SendMessageW.USER32(015477A8,000000B0,?,?), ref: 00768051
IsDlgButtonChecked.USER32(?,?), ref: 00768089
GetWindowLongW.USER32(015477A8,000000EC), ref: 007680AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 007680C3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c0e8291c25d128e2d282994be8d75a399241a6fceacb198985322ef6493fe03a
Instruction ID: a1a4112e678f49ea06e08c269b9b0f82e5d11210497279ebab06375b5c4aefbe
Opcode Fuzzy Hash: c0e8291c25d128e2d282994be8d75a399241a6fceacb198985322ef6493fe03a
Instruction Fuzzy Hash: A971CF34608204AFEB299F64C884FFA7BB5EF0A384F144599FD4793261CB79AC46CB10

Function 0073AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0073AEF9
GetKeyboardState.USER32(?), ref: 0073AF0E
SetKeyboardState.USER32(?), ref: 0073AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0073AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0073AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0073AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0073B020

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c6b0677d31a133b0d5b3dc77feeb8cfc124040251a42e2102a794be778532668
Instruction ID: 16a6b96ed0d673094e6aa13202e88f6780cdc55d6e41ce18a1dd90e1f356f48a
Opcode Fuzzy Hash: c6b0677d31a133b0d5b3dc77feeb8cfc124040251a42e2102a794be778532668
Instruction Fuzzy Hash: 9E5182A06047D63DFB364234C84ABBBBEA95B06304F088589E2D9594D3D3DDEDC8D751

Function 0073ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0073AD19
GetKeyboardState.USER32(?), ref: 0073AD2E
SetKeyboardState.USER32(?), ref: 0073AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0073ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0073ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0073AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0073AE38

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: af5ae70e6b4cd819382befcc31a51b298cd98d25e86410dd415f496c1cd5ffad
Instruction ID: 0447e52ab97c429342cdcf0af972e4bdb83a60a4f4b22822ef6659b011641b9f
Opcode Fuzzy Hash: af5ae70e6b4cd819382befcc31a51b298cd98d25e86410dd415f496c1cd5ffad
Instruction Fuzzy Hash: 5551D2A1A547D53DFB378334CC57B7ABEA86B46300F088588E1D54A8C3D29CEC88D762

Function 0070542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00713CD6,?,?,?,?,?,?,?,?,00705BA3,?,?,00713CD6,?,?), ref: 00705470
__fassign.LIBCMT ref: 007054EB
__fassign.LIBCMT ref: 00705506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00713CD6,00000005,00000000,00000000), ref: 0070552C
WriteFile.KERNEL32(?,00713CD6,00000000,00705BA3,00000000,?,?,?,?,?,?,?,?,?,00705BA3,?), ref: 0070554B
WriteFile.KERNEL32(?,?,00000001,00705BA3,00000000,?,?,?,?,?,?,?,?,?,00705BA3,?), ref: 00705584

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 72148edba0950030cd261861e038906098e80c9f425ffcf3c2ccfba6e8bb0a1d
Instruction ID: 93e5faad942c77b0f136366034d5f8c680b91afc7a060824a6dc58f200d304ff
Opcode Fuzzy Hash: 72148edba0950030cd261861e038906098e80c9f425ffcf3c2ccfba6e8bb0a1d
Instruction Fuzzy Hash: 3351D1B0A00648DFDB11CFA8DC45AEEBBFAEF09300F14421AF546E3291E6349A51CF64

Function 007510B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
Part of subcall function 0075304E: _wcslen.LIBCMT ref: 0075309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00751112
WSAGetLastError.WSOCK32 ref: 00751121
WSAGetLastError.WSOCK32 ref: 007511C9
closesocket.WSOCK32(00000000), ref: 007511F9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: cc31d782b140be486cd05b6e0f5af7f5728540ecf732877cb0a390cfa3051aa6
Instruction ID: feb7fcc3ecfa8e6373ac689c27c791dc93df588096a601cf97eda304a8dc937c
Opcode Fuzzy Hash: cc31d782b140be486cd05b6e0f5af7f5728540ecf732877cb0a390cfa3051aa6
Instruction Fuzzy Hash: 73412731600608AFDB109F24C884BE9B7EAEF44326F148099FD469B291C7B8ED45CBE5

Function 0073CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0073CF22,?), ref: 0073DDFD

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0073CF22,?), ref: 0073DE16

lstrcmpiW.KERNEL32(?,?), ref: 0073CF45
MoveFileW.KERNEL32(?,?), ref: 0073CF7F
_wcslen.LIBCMT ref: 0073D005
_wcslen.LIBCMT ref: 0073D01B
SHFileOperationW.SHELL32(?), ref: 0073D061

Strings

\*.*, xrefs: 0073CFF3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 373d02fcb99c48e86bf8d21b40618f4b2438aaaa9cbbe721821abaf7dd37aecd
Instruction ID: 9601f03266f9bd683ce9cf6b0f7c8f76a9196e5331cd82915d131985145e2991
Opcode Fuzzy Hash: 373d02fcb99c48e86bf8d21b40618f4b2438aaaa9cbbe721821abaf7dd37aecd
Instruction Fuzzy Hash: 06414672D0521D9EEF16EBA4D985AEE77B9AF08340F0000E6E545EB142EB38AA44CF54

Function 00762DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00762E1C
GetWindowLongW.USER32(?,000000F0), ref: 00762E4F
GetWindowLongW.USER32(?,000000F0), ref: 00762E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00762EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00762EE0
GetWindowLongW.USER32(?,000000F0), ref: 00762EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00762F0B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 7a5ad5d8c28bb9b865106da4adab3ab8c8fc295b98a752fb29028662771842c9
Instruction ID: b9434c6ee2478be88427f775a08e3c143a25a46c4fd52119f2fb3df546c61c9b
Opcode Fuzzy Hash: 7a5ad5d8c28bb9b865106da4adab3ab8c8fc295b98a752fb29028662771842c9
Instruction Fuzzy Hash: C23139306446409FEB61CF58DC88F6537E0FB9A710F1541A5F9529F2B2CBBAAC41DB09

Function 00737726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0073778F
SysAllocString.OLEAUT32(00000000), ref: 00737792
SysAllocString.OLEAUT32(?), ref: 007377B0
SysFreeString.OLEAUT32(?), ref: 007377B9
StringFromGUID2.OLE32(?,?,00000028), ref: 007377DE
SysAllocString.OLEAUT32(?), ref: 007377EC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ae2f9b488b6f9f52b955cbb3403961df9a8795d3745ba55a620f4a1e393b2208
Instruction ID: 905302cf645ea7bf19f148562bf9405b07415cf1316ca88ab69910b5868b256d
Opcode Fuzzy Hash: ae2f9b488b6f9f52b955cbb3403961df9a8795d3745ba55a620f4a1e393b2208
Instruction Fuzzy Hash: 4721C4B6609219AFEF24DFA9CC88CBB77ACEB09364B008025F905DB151DAB8DC41C764

Function 007377FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737868
SysAllocString.OLEAUT32(00000000), ref: 0073786B
SysAllocString.OLEAUT32 ref: 0073788C
SysFreeString.OLEAUT32 ref: 00737895
StringFromGUID2.OLE32(?,?,00000028), ref: 007378AF
SysAllocString.OLEAUT32(?), ref: 007378BD

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: cd21087dd08ac2f9ae99f55ef1a73ab212d5b0bca808aef6fdc20b5b21252ffd
Instruction ID: e8c4cc6ed81ea05ec160518e5ebf34c4d69a3caa67b58542d631519cc673d62e
Opcode Fuzzy Hash: cd21087dd08ac2f9ae99f55ef1a73ab212d5b0bca808aef6fdc20b5b21252ffd
Instruction Fuzzy Hash: 3921C771605305BFEB249FA9CC88DBA77ECEB09360B108025F955DB1A1DA78DC41CB68

Function 007404D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007404F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0074052E

Strings

nul, xrefs: 00740567

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a3b9fd20309b675d013962801efb4031f8a59f66ce1eaac0174a8aa3c32314d0
Instruction ID: 1ed6b0ae9746cf76329a977088bf188d6789a4ecf8eb0a35fe2322b87cdec4d2
Opcode Fuzzy Hash: a3b9fd20309b675d013962801efb4031f8a59f66ce1eaac0174a8aa3c32314d0
Instruction Fuzzy Hash: D72162755003059FDF209F29DC44E5AB7A4FF45724F204A19F9A1E72E0D7749960CFA0

Function 007405A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007405C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00740601

Strings

nul, xrefs: 00740639

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: bcd0efed980d3023c39921f52fa58164d8d19dbd06c047e5e0b18597057b5c57
Instruction ID: b03be76a21f565ee09cbc3a2660e6efd93a7f04d0da6d579e47c2e76eeaef315
Opcode Fuzzy Hash: bcd0efed980d3023c39921f52fa58164d8d19dbd06c047e5e0b18597057b5c57
Instruction Fuzzy Hash: 7421A3755003059FDB209F698C08A6A77E4BF85720F204A19FEA2E72D0D7B49860CB95

Function 007640AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
Part of subcall function 006D600E: GetStockObject.GDI32(00000011), ref: 006D6060
Part of subcall function 006D600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00764112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0076411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0076412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00764139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00764145

Strings

Msctls_Progress32, xrefs: 007640E3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3ecfc59030ac7d15fad0aa5f2d1c86abb04ce2bb1f493cc7eba3eb5208b7fe63
Instruction ID: 93e9be30a6fade97cbfa1dfe121dc6c79434937424a38b0d17747306aba4796b
Opcode Fuzzy Hash: 3ecfc59030ac7d15fad0aa5f2d1c86abb04ce2bb1f493cc7eba3eb5208b7fe63
Instruction Fuzzy Hash: 2811B2B215021DBEEF119F64CC85EE77F9DEF09798F008111FB18A2150C6769C61DBA4

Function 0070D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0070D7A3: _free.LIBCMT ref: 0070D7CC

_free.LIBCMT ref: 0070D82D

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070D838
_free.LIBCMT ref: 0070D843
_free.LIBCMT ref: 0070D897
_free.LIBCMT ref: 0070D8A2
_free.LIBCMT ref: 0070D8AD
_free.LIBCMT ref: 0070D8B8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 024ac15da0b9ead7d85a1111eb4275f0f5704047666e8745ef4d7d909c2409d9
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 4D111F72540B04EAD531BFF4CC4FFCB7BDC6F44700F405A25B299A64E3DA69B9064A50

Function 0073DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0073DA74
LoadStringW.USER32(00000000), ref: 0073DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0073DA91
LoadStringW.USER32(00000000), ref: 0073DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0073DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0073DAB9

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: f647ab84417c0893590261e75d3c1f7d0b3d07478031c99ad41f574c072ce597
Instruction ID: 0058098c906b0a97d094fa9ce3aede9b8d9f6a5691325e5b7c5e842c360f8389
Opcode Fuzzy Hash: f647ab84417c0893590261e75d3c1f7d0b3d07478031c99ad41f574c072ce597
Instruction Fuzzy Hash: 8501FFF6500308BBF7129BA49D89EF6766CE708701F408596F786E2042E6B89E844B78

Function 0074096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0153BAC0,0153BAC0), ref: 0074097B
EnterCriticalSection.KERNEL32(0153BAA0,00000000), ref: 0074098D
TerminateThread.KERNEL32(?,000001F6), ref: 0074099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 007409A9
CloseHandle.KERNEL32(?), ref: 007409B8
InterlockedExchange.KERNEL32(0153BAC0,000001F6), ref: 007409C8
LeaveCriticalSection.KERNEL32(0153BAA0), ref: 007409CF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 29e0ea2f7e5493783159cc9e6b0c0d07287a7c6a370f32ca219b43f5a54b5196
Instruction ID: 85db687b73f16f64aa41c217686148b59ab7c0e1b06ea22aaf8513662847196b
Opcode Fuzzy Hash: 29e0ea2f7e5493783159cc9e6b0c0d07287a7c6a370f32ca219b43f5a54b5196
Instruction Fuzzy Hash: 24F03131442602BFD7425FA5EE9DBE67B35FF01702F405015F242608A0C7B9A465CFA4

Function 006D5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 006D5D30
GetWindowRect.USER32(?,?), ref: 006D5D71
ScreenToClient.USER32(?,?), ref: 006D5D99
GetClientRect.USER32(?,?), ref: 006D5ED7
GetWindowRect.USER32(?,?), ref: 006D5EF8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: d3800465b3f7920259353dffe9251212d64265f9d6896ad315226f14f4b12853
Instruction ID: d26d6dae8906151cc31e128eb10724c17de96b92b6bd2bec4a994c9578a27b11
Opcode Fuzzy Hash: d3800465b3f7920259353dffe9251212d64265f9d6896ad315226f14f4b12853
Instruction Fuzzy Hash: 1EB16A34A0074ADBDB10DFA9C4407EEB7F2FF58310F14851AE8AAD7690DB34AA91DB54

Function 007001B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007000BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007000D6
__allrem.LIBCMT ref: 007000ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0070010B
__allrem.LIBCMT ref: 00700122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00700140

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: f49cd91cffde22e3993c3d97fd14a2f106fb5a77b9949b683dd6bac3631d9c37
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 2E810872A01B0ADBE7209F68CC45BAE73EAAF41734F24463EF651D62C1E778D9408790

Function 00751D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00753149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0075101C,00000000,?,?,00000000), ref: 00753195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00751DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00751DE1
WSAGetLastError.WSOCK32 ref: 00751DF2
inet_ntoa.WSOCK32(?), ref: 00751E8C
htons.WSOCK32(?,?,?,?,?), ref: 00751EDB
_strlen.LIBCMT ref: 00751F35

Part of subcall function 007339E8: _strlen.LIBCMT ref: 007339F2

Part of subcall function 006D6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,006ECF58,?,?,?), ref: 006D6DBA
Part of subcall function 006D6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,006ECF58,?,?,?), ref: 006D6DED

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 057f7f2d8b6cd14a782773a7f0928c9c93bf81d6a382cce48d784b30b49acdc4
Instruction ID: 0b4a16d594d74825307a6f063489256bc2abc2ce5864caa5a89f2d62cc09bdb1
Opcode Fuzzy Hash: 057f7f2d8b6cd14a782773a7f0928c9c93bf81d6a382cce48d784b30b49acdc4
Instruction Fuzzy Hash: 8DA10330604340AFD324DF20C895F6A77E6AF84319F94894CF8565B2E2CBB5ED4ACB91

Function 007061FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006F82D9,006F82D9,?,?,?,0070644F,00000001,00000001,8BE85006), ref: 00706258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0070644F,00000001,00000001,8BE85006,?,?,?), ref: 007062DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007063D8
__freea.LIBCMT ref: 007063E5

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

__freea.LIBCMT ref: 007063EE
__freea.LIBCMT ref: 00706413

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: af83f7516c0654e0fecd1d957314104961cf34eb2aa30535d4abe13ed594feda
Instruction ID: 8b64dd50df4397370da4e6f25fc985e084d4730df93016cf20860a7b9b143cdd
Opcode Fuzzy Hash: af83f7516c0654e0fecd1d957314104961cf34eb2aa30535d4abe13ed594feda
Instruction Fuzzy Hash: EC51AF72600216EBEB258F64CC95EBFB6E9EB44754F144729F905D61C1DB38DC60C6A0

Function 0075BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075BD25
RegCloseKey.ADVAPI32(00000000), ref: 0075BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0075BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0075BDF3
RegCloseKey.ADVAPI32(?), ref: 0075BDFF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 0a9290f255a5563e7a03521ce2c939c56089eedd0680874a811b6ad721ed6cfe
Instruction ID: d2654c93a04d55d8f3bc9f8b90b4b1613de51ef239718020df0784aef7d00bc5
Opcode Fuzzy Hash: 0a9290f255a5563e7a03521ce2c939c56089eedd0680874a811b6ad721ed6cfe
Instruction Fuzzy Hash: 34818C30208341AFD715DF24C895E6ABBE5FF84308F14895DF8964B2A2DB75ED09CB92

Function 0072F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0072F7B9
SysAllocString.OLEAUT32(00000001), ref: 0072F860
VariantCopy.OLEAUT32(0072FA64,00000000), ref: 0072F889
VariantClear.OLEAUT32(0072FA64), ref: 0072F8AD
VariantCopy.OLEAUT32(0072FA64,00000000), ref: 0072F8B1
VariantClear.OLEAUT32(?), ref: 0072F8BB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: ffd236c9894e87c82aa67d7e1ffcd979f89132961e2e0e00d221c8d833330f40
Instruction ID: 3fa2ff2b4617be4cf224a4d7478e514ae739d5d5904191b57e8f6754f3a75f48
Opcode Fuzzy Hash: ffd236c9894e87c82aa67d7e1ffcd979f89132961e2e0e00d221c8d833330f40
Instruction Fuzzy Hash: BB51D631501320FBCF10AB65E895B39B7B5EF45310B20947BE846DF295DB789C80CB6A

Function 0074910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 007494E5
_wcslen.LIBCMT ref: 00749506
_wcslen.LIBCMT ref: 0074952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00749585

Strings

X, xrefs: 00749412

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: bfb722020e862daccb27f88e5c7f0d4ab24e128ba50515173300d4bb2cda47e1
Instruction ID: 850dce11c78de4b7de1c64a23cf7f15604053cf3f47aa04a0c535898a727285d
Opcode Fuzzy Hash: bfb722020e862daccb27f88e5c7f0d4ab24e128ba50515173300d4bb2cda47e1
Instruction Fuzzy Hash: CDE1AE31A083409FC764DF24C881A6BB7E1BF85314F14896DF9899B3A2EB35DD05CB96

Function 006E920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

BeginPaint.USER32(?,?,?), ref: 006E9241
GetWindowRect.USER32(?,?), ref: 006E92A5
ScreenToClient.USER32(?,?), ref: 006E92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 006E92D3
EndPaint.USER32(?,?,?,?,?), ref: 006E9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007271EA

Part of subcall function 006E9339: BeginPath.GDI32(00000000), ref: 006E9357

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 38ea0b68587e41847d58a21dbd254755bf241000b0f46e1f5c7ee1a16015cdea
Instruction ID: 406f56c88ab487128e234f3c1157ec71c64a1cf9239508a59b34d8c4eb5b0573
Opcode Fuzzy Hash: 38ea0b68587e41847d58a21dbd254755bf241000b0f46e1f5c7ee1a16015cdea
Instruction Fuzzy Hash: 7941E030105340AFE711DF25DC84FBB7BA9EF86320F104229FAA5872E1C774A845DB66

Function 007407EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0074080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00740847
EnterCriticalSection.KERNEL32(?), ref: 00740863
LeaveCriticalSection.KERNEL32(?), ref: 007408DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 007408F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00740921

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: dce4ddadd27004397e1219437553e1711c80119b41a882f2dfc341a87242fccc
Instruction ID: 176038c1395d604e9a5befa5a508e98b62bc0755d1b71423d633178c50660099
Opcode Fuzzy Hash: dce4ddadd27004397e1219437553e1711c80119b41a882f2dfc341a87242fccc
Instruction Fuzzy Hash: 28419C71900205EFEF05AF54DC85A6A7779FF04300F1080A9EE00AA297DB74EE65DBA8

Function 007681DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0072F3AB,00000000,?,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0076824C
EnableWindow.USER32(?,00000000), ref: 00768272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 007682D1
ShowWindow.USER32(?,00000004), ref: 007682E5
EnableWindow.USER32(?,00000001), ref: 0076830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0076832F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 2ac1a5c29f5fe90d9aac1d4f4f798fbe6ce6075ddb300de8d99bb6ea6498d3be
Instruction ID: 496c3847ef0e472e8fc63a7f21895a7a5a06340e9cf15d6852dc64cdd15b8fdd
Opcode Fuzzy Hash: 2ac1a5c29f5fe90d9aac1d4f4f798fbe6ce6075ddb300de8d99bb6ea6498d3be
Instruction Fuzzy Hash: 7241E830601640EFDB56CF15C8A9BE87BE0FB46714F1843A9E94A4F272CB39A841CB46

Function 00734C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00734C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00734CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00734CEA
_wcslen.LIBCMT ref: 00734D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00734D10
_wcsstr.LIBVCRUNTIME ref: 00734D1A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a5b25cb256d19a35022ddd922d95c7d6710ec0aa7c196ef7996c8c87d673969a
Instruction ID: 652acf3116213d61dedf365a65aee826ed49ec27f3cca9cf57ff2e2045c466d2
Opcode Fuzzy Hash: a5b25cb256d19a35022ddd922d95c7d6710ec0aa7c196ef7996c8c87d673969a
Instruction Fuzzy Hash: B2212932305304BBFB195B35EC09E7B7B9DDF45750F10806DF905CA192EEA9EC0086A4

Function 0074581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

_wcslen.LIBCMT ref: 0074587B
CoInitialize.OLE32(00000000), ref: 00745995
CoCreateInstance.OLE32(0076FCF8,00000000,00000001,0076FB68,?), ref: 007459AE
CoUninitialize.OLE32 ref: 007459CC

Strings

.lnk, xrefs: 00745876, 007458C1, 00745985

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: c94bdcb5356e88c5c068ab8dba1a093f5b7c3958d45d01a1fe4b443b555559cf
Instruction ID: 34272237e39419d327b684f75dea15cc4c646b881185779a39875e0e21873e5a
Opcode Fuzzy Hash: c94bdcb5356e88c5c068ab8dba1a093f5b7c3958d45d01a1fe4b443b555559cf
Instruction Fuzzy Hash: 7ED143B1A08701DFC714DF24C48492ABBE6EF89710F14895DF88A9B362DB35EC45CB92

Function 0073175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00730FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00730FCA
Part of subcall function 00730FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00730FD6
Part of subcall function 00730FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00730FE5
Part of subcall function 00730FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00730FEC
Part of subcall function 00730FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00731002

GetLengthSid.ADVAPI32(?,00000000,00731335), ref: 007317AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007317BA
HeapAlloc.KERNEL32(00000000), ref: 007317C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 007317DA
GetProcessHeap.KERNEL32(00000000,00000000,00731335), ref: 007317EE
HeapFree.KERNEL32(00000000), ref: 007317F5

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ef3157d1178847a0f2e254d23b2e48c8bef6dc1568ed7cfab561c10aea7ddfd2
Instruction ID: ce9f4102562c6a17b14b863ccf99e89bef7022874a9e246e2233330f1cbae1e7
Opcode Fuzzy Hash: ef3157d1178847a0f2e254d23b2e48c8bef6dc1568ed7cfab561c10aea7ddfd2
Instruction Fuzzy Hash: FC11BE71500205FFEB259FA4CC49BBE7BA9EB42355F588018F48297212D77AAD44CB70

Function 007314CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007314FF
OpenProcessToken.ADVAPI32(00000000), ref: 00731506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00731515
CloseHandle.KERNEL32(00000004), ref: 00731520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0073154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00731563

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 30ace8396ff4b67202ace4f4f5582e1ac98434b35af4cc632e69d70966ce7b31
Instruction ID: 7752e96556bf7098752836b9a4189164ee6656ee30418db30c411410b39aff72
Opcode Fuzzy Hash: 30ace8396ff4b67202ace4f4f5582e1ac98434b35af4cc632e69d70966ce7b31
Instruction Fuzzy Hash: E9116A7250024DEBEF128F98DD49FEE7BA9EF48744F048015FA06A2160C3B9CE60DB60

Function 006F3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006F3379,006F2FE5), ref: 006F3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006F339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006F33B7
SetLastError.KERNEL32(00000000,?,006F3379,006F2FE5), ref: 006F3409

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9faf0e6114e82186a29b23a65a88ace68f1fd350a4558ccde31e71ff58ca6ca7
Instruction ID: 9529aa9e34b84ad00dae042c4f8f1d4d761b0bd74a4551f670112d56e64e3996
Opcode Fuzzy Hash: 9faf0e6114e82186a29b23a65a88ace68f1fd350a4558ccde31e71ff58ca6ca7
Instruction Fuzzy Hash: 35012433208339BEAA2627787C85AB72A96EB15379B20422EF710C43F0EF554D12514C

Function 00702D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00705686,00713CD6,?,00000000,?,00705B6A,?,?,?,?,?,006FE6D1,?,00798A48), ref: 00702D78
_free.LIBCMT ref: 00702DAB
_free.LIBCMT ref: 00702DD3
SetLastError.KERNEL32(00000000,?,?,?,?,006FE6D1,?,00798A48,00000010,006D4F4A,?,?,00000000,00713CD6), ref: 00702DE0
SetLastError.KERNEL32(00000000,?,?,?,?,006FE6D1,?,00798A48,00000010,006D4F4A,?,?,00000000,00713CD6), ref: 00702DEC
_abort.LIBCMT ref: 00702DF2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 1bf2c61ca496c118ac84d8d4ab22444a04b3b128eba0b0ea8065ae74983b2727
Instruction ID: 6cfdca0e940aa55a786ef650f56660886d82423e6a7976676cc39de376e08ec3
Opcode Fuzzy Hash: 1bf2c61ca496c118ac84d8d4ab22444a04b3b128eba0b0ea8065ae74983b2727
Instruction Fuzzy Hash: 40F0A477644600F7C6137735AC0EA2A26D9AFC27A5B358719F825922E3EE6C9C034165

Function 00768A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 006E9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96A2
Part of subcall function 006E9639: BeginPath.GDI32(?), ref: 006E96B9
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00768A4E
LineTo.GDI32(?,00000003,00000000), ref: 00768A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00768A70
LineTo.GDI32(?,00000000,00000003), ref: 00768A80
EndPath.GDI32(?), ref: 00768A90
StrokePath.GDI32(?), ref: 00768AA0

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: f550b3b9478693dd57922e8204f6d2f56b350bbdddb44621cd323f9a5b4d8501
Instruction ID: 52592dd170973d18b7b48f2c46c376cab8ae405443b3a318e06d09a373665f71
Opcode Fuzzy Hash: f550b3b9478693dd57922e8204f6d2f56b350bbdddb44621cd323f9a5b4d8501
Instruction Fuzzy Hash: 6011FA7600024CFFEB129F94DC48EAA7F6DEB08350F00C012FA5699161C7759D55DBA4

Function 007351FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00735218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00735229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00735230
ReleaseDC.USER32(00000000,00000000), ref: 00735238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0073524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00735261

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 76eabd7d5670af19740b4cf0828191f4f75e8da2679fba080eb5bd5d5bf2d6e3
Instruction ID: 2e758272dbe18e8a85b09aafdbf5d1e91300496cf326e1cbe9440c3b58ecdc2d
Opcode Fuzzy Hash: 76eabd7d5670af19740b4cf0828191f4f75e8da2679fba080eb5bd5d5bf2d6e3
Instruction Fuzzy Hash: 65018FB5A00718BBEB119BA5DC49A5EBFB8FB48351F048066FA05A7281D6B49800CBA4

Function 006D1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: f8f573ff264a3accc1374b1108628eac8e54e81d8ab5dede308f89756a343562
Instruction ID: 04f8397cd30ee4ca6652d0ca47f51ccfab23aec15ea65f99ff32b51637731597
Opcode Fuzzy Hash: f8f573ff264a3accc1374b1108628eac8e54e81d8ab5dede308f89756a343562
Instruction Fuzzy Hash: B50148B090275A7DE3008F5A8C85A52FEA8FF19354F00415B915C47941C7F5A864CBE5

Function 0073EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0073EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0073EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0073EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB75

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 97f5b6ac5880c7a9c23156c82bb810a0581617701c6eb053d980895b06a0684a
Instruction ID: e84d1ee2c240ca9e514bce230c3ac318a71878f39679f3d13464842d4fe44adc
Opcode Fuzzy Hash: 97f5b6ac5880c7a9c23156c82bb810a0581617701c6eb053d980895b06a0684a
Instruction Fuzzy Hash: BCF01DB2140258BBE6226752DC0EEBB7A7CEFCAB11F008158F642E119196E85A0186B9

Function 00727439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00727452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00727469
GetWindowDC.USER32(?), ref: 00727475
GetPixel.GDI32(00000000,?,?), ref: 00727484
ReleaseDC.USER32(?,00000000), ref: 00727496
GetSysColor.USER32(00000005), ref: 007274B0

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 56e8d662c2ec022928b0fc2c3a009533f9be6e994307af506aef4df51e9a94cc
Instruction ID: dcf92beec899307d520581f1c77654c3c05a388ef2c6bbd20112727ae290b071
Opcode Fuzzy Hash: 56e8d662c2ec022928b0fc2c3a009533f9be6e994307af506aef4df51e9a94cc
Instruction Fuzzy Hash: D801AD31400355EFEB126FA4EC08BBA7BB5FF04311F608060F956A21A1CB791E51EB54

Function 00731874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0073187F
UnloadUserProfile.USERENV(?,?), ref: 0073188B
CloseHandle.KERNEL32(?), ref: 00731894
CloseHandle.KERNEL32(?), ref: 0073189C
GetProcessHeap.KERNEL32(00000000,?), ref: 007318A5
HeapFree.KERNEL32(00000000), ref: 007318AC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c1923dbc58f787326767a73917f90bf901ac767ab05dcdeec0e15f16198bfdc0
Instruction ID: 141c59215779c5d4788b32c57112b7e50769a73c984b7c135b9074fcd14691a2
Opcode Fuzzy Hash: c1923dbc58f787326767a73917f90bf901ac767ab05dcdeec0e15f16198bfdc0
Instruction Fuzzy Hash: D1E0ED76004205BBDB026FA2ED0C915BF39FF4A722710C221F26691170CBB65420DF64

Function 006DBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006DBEB3

Strings

D%zD%z, xrefs: 006DBCA5
D%z, xrefs: 006DBCA2
D%z, xrefs: 006DBDED, 006DBD91, 006DBD1B
D%z, xrefs: 006DBE9A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%z$D%z$D%z$D%zD%z
API String ID: 1385522511-3299656855
Opcode ID: 1820b6924b1cda8e42478be900116b557a273e6a701fc6d5d1c3541a110da116
Instruction ID: 76cdcd034df3da95fbb41347c63be535bc09ddb897b6cc40f19f547912ba22df
Opcode Fuzzy Hash: 1820b6924b1cda8e42478be900116b557a273e6a701fc6d5d1c3541a110da116
Instruction Fuzzy Hash: 69913975E0020ACFCB18CF59C0906A9B7F2FF99310B25916ED945AB355E731E982CB90

Function 00757B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 006F0242: EnterCriticalSection.KERNEL32(007A070C,007A1884,?,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F024D
Part of subcall function 006F0242: LeaveCriticalSection.KERNEL32(007A070C,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F028A

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

__Init_thread_footer.LIBCMT ref: 00757BFB

Part of subcall function 006F01F8: EnterCriticalSection.KERNEL32(007A070C,?,?,006E8747,007A2514), ref: 006F0202
Part of subcall function 006F01F8: LeaveCriticalSection.KERNEL32(007A070C,?,006E8747,007A2514), ref: 006F0235

Strings

G, xrefs: 00757C7F
+Tr, xrefs: 00757E2E
5, xrefs: 00757C78
Variable must be of type 'Object'., xrefs: 00757C3A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +Tr$5$G$Variable must be of type 'Object'.
API String ID: 535116098-3922178991
Opcode ID: 69b93b727b44e29a7194eadef550005d2bc8386a8ca663d4566c705ca4757f4e
Instruction ID: 2206e359d11c50ddeb99546b003d16ca6d0b0d8ef8046fee7470b2ae0cee4b54
Opcode Fuzzy Hash: 69b93b727b44e29a7194eadef550005d2bc8386a8ca663d4566c705ca4757f4e
Instruction Fuzzy Hash: 33916E70A04209EFCB08EF54E8959FDB7B6BF45301F108059FC069B292DBB9AE49CB51

Function 0073C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0073C6EE
_wcslen.LIBCMT ref: 0073C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0073C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0073C7CA

Strings

0, xrefs: 0073C6AF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: c567fa4b57eb49a287332b324a1ae2cd4b2cb888b154dab2167d4fd9bd782fc4
Instruction ID: e5643bfa15046385d4a978f1d28c96324a376140dacba306339e2fa206df9a4f
Opcode Fuzzy Hash: c567fa4b57eb49a287332b324a1ae2cd4b2cb888b154dab2167d4fd9bd782fc4
Instruction Fuzzy Hash: 4751E2726043409BF7529F28C885B6B77E8AF89310F040A2DF996F31A2DB78DD04CB56

Function 0075AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0075AEA3

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

GetProcessId.KERNEL32(00000000), ref: 0075AF38
CloseHandle.KERNEL32(00000000), ref: 0075AF67

Strings

<, xrefs: 0075AE6B
@, xrefs: 0075AE72

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: e1e12c8f208c2dbca7ca0bcd0c95e86d9837bd8e14e6a2edc4c8bb603099af5c
Instruction ID: b2ca69c7a6418ea6f542347675365c20de0372fe578b24fc5c439158ad828611
Opcode Fuzzy Hash: e1e12c8f208c2dbca7ca0bcd0c95e86d9837bd8e14e6a2edc4c8bb603099af5c
Instruction Fuzzy Hash: 18715971A00219DFCB14DF54D485A9EBBF1BF08310F0485AEE816AB392DB74ED45CB95

Function 0073719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00737206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0073723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0073724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007372CF

Strings

DllGetClassObject, xrefs: 00737242

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 8fae348152053146573f0432cfc1cf529a9a94566f8e5d63617a85e3d866545e
Instruction ID: c411d1eb9db18e9f20f84f30a2d6589b7704a4370115330de7fa7a5e61e04184
Opcode Fuzzy Hash: 8fae348152053146573f0432cfc1cf529a9a94566f8e5d63617a85e3d866545e
Instruction Fuzzy Hash: E5411DF2604205DFEB29CF54C884A9B7BB9FF49310F1580A9BD059F20AD7B9D944DBA0

Function 00763D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00763E35
IsMenu.USER32(?), ref: 00763E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00763E92
DrawMenuBar.USER32 ref: 00763EA5

Strings

0, xrefs: 00763D89

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: c26ca9e4dd11e2fddd3b6d695ea88e53da2c680bf7815008ee79ea95f14475bb
Instruction ID: 1444509be4a0fe0ca9abc126282856dbd0383d0e7686fb6e3f6dbb8da29a59d9
Opcode Fuzzy Hash: c26ca9e4dd11e2fddd3b6d695ea88e53da2c680bf7815008ee79ea95f14475bb
Instruction Fuzzy Hash: F0414775A01209AFDB10DF60D884AAABBF9FF49350F04812AFD16A7250D739AE54CF60

Function 00731DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00731E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00731E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00731EA9

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Strings

ListBox, xrefs: 00731E25
ComboBox, xrefs: 00731DF0

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 6c93860f10853a2d4d529416e33d0032abce277de2990f72f23751a3a5261e6a
Instruction ID: 144f17d4fb896703ed7f25c9df1c823161e03310a372a7ded0a9646644ca9ddc
Opcode Fuzzy Hash: 6c93860f10853a2d4d529416e33d0032abce277de2990f72f23751a3a5261e6a
Instruction Fuzzy Hash: AB2123B2A40204BEEB14AB60DC45CFFB7B9DF41350F54451EF822A32E2DB7D4D098624

Function 0075C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0075C9F1
_wcslen.LIBCMT ref: 0075CA68
_wcslen.LIBCMT ref: 0075CA9E
_wcslen.LIBCMT ref: 0075CAF9
_wcslen.LIBCMT ref: 0075CB2F
_wcslen.LIBCMT ref: 0075CB7F

Strings

HKLM, xrefs: 0075CA98, 0075CA9D
HKEY_LOCAL_MACHINE, xrefs: 0075CA62, 0075CA67

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 548af75eb8b65f76a841b9cd07578a58e523117c82e4d16ea521d657c73aa2ac
Instruction ID: 313341458b71fb8ee421b277f3af122373837473f698d44659b27720320bf3ac
Opcode Fuzzy Hash: 548af75eb8b65f76a841b9cd07578a58e523117c82e4d16ea521d657c73aa2ac
Instruction Fuzzy Hash: CB31D772A002694FCB22DF2C99406FF3B925BA1751B15802DEC456B345EAF9CD48D3A4

Function 00762F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00762F8D
LoadLibraryW.KERNEL32(?), ref: 00762F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00762FA9
DestroyWindow.USER32(?), ref: 00762FB1

Strings

SysAnimate32, xrefs: 00762F68

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 0eebaf71a50527c5f26ccc9d03f3d60966a4ab20ceea4e55203df512bd9c4897
Instruction ID: adec3db30a13d66e342eb2a37a270546e534539d3a460560a75e3227ef2b74ea
Opcode Fuzzy Hash: 0eebaf71a50527c5f26ccc9d03f3d60966a4ab20ceea4e55203df512bd9c4897
Instruction Fuzzy Hash: 7621DE71204605ABEB514FA4DC80EFB37B9EF59364F108618FE52D61A1C7B9DC429B60

Function 006F4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006F4D1E,007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002), ref: 006F4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006F4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,006F4D1E,007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000), ref: 006F4DC3

Strings

mscoree.dll, xrefs: 006F4D86
CorExitProcess, xrefs: 006F4D98

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a049f690f4cbf51a17be44465992fd00fb22dc04e0f73f63edc27ef81d521838
Instruction ID: 258562cd605416a438d072dd977abc58dd594bffcc21d92d8f0b54901819460e
Opcode Fuzzy Hash: a049f690f4cbf51a17be44465992fd00fb22dc04e0f73f63edc27ef81d521838
Instruction Fuzzy Hash: 71F0813050020CABDB159B94DC09BFEBBA5EF44751F004095E90AA2650DB745D40CAD4

Function 0072D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0072D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0072D3BF
FreeLibrary.KERNEL32(00000000), ref: 0072D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0072D3B9
X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 82e93b54213b02991a579f62d4f93873eb9722f67e68129a711be70db5532b82
Instruction ID: f08101681890dacfcaccd71e2aff04959e5da7f0330e2420a7c3307487db59af
Opcode Fuzzy Hash: 82e93b54213b02991a579f62d4f93873eb9722f67e68129a711be70db5532b82
Instruction Fuzzy Hash: A1F055B0802730CBE736AB11EC189BD7351BF02701F68C196F843E1002DB6CCE408687

Function 006D4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 006D4EA8
kernel32.dll, xrefs: 006D4E94

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 9d5ce33633201b8f879a8db36e3ca157817e20daa987039bf88cb54275b40043
Instruction ID: 0f5f9f2ec540540f642a2e679f1964a5c1bae3f48832e1a6788cdcc52f817ce8
Opcode Fuzzy Hash: 9d5ce33633201b8f879a8db36e3ca157817e20daa987039bf88cb54275b40043
Instruction Fuzzy Hash: 18E0CD75E017226BD23317257C18BBF7755AF82F627094116FC46D2300DFB8CD0140A4

Function 006D4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 006D4E6E
kernel32.dll, xrefs: 006D4E5B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 659d644e2e34fd384737fe50803d7a64dc8530789483f8d4ce3e1997e85353df
Instruction ID: 1e287c962f316968d2365e3f51110a7c30c07a87d38941802b722ec1666283b7
Opcode Fuzzy Hash: 659d644e2e34fd384737fe50803d7a64dc8530789483f8d4ce3e1997e85353df
Instruction Fuzzy Hash: 92D0C271902761674A231B24BC08DEB3B1AAFC6B513054212F846A2310CFB8CD0181D4

Function 00742947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742C05
DeleteFileW.KERNEL32(?), ref: 00742C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00742C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742CC0

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 951dadf4e42b2a496bdfdfafa92948b4c94ab449b84689ef89dd01fb5f12b46f
Instruction ID: 445dfe9723d1cc7f5bda5f376bfaf13b66ee5bf9e829e6538597da3803ab7554
Opcode Fuzzy Hash: 951dadf4e42b2a496bdfdfafa92948b4c94ab449b84689ef89dd01fb5f12b46f
Instruction Fuzzy Hash: 10B16EB1D0011DABDF11DBA4CC85EEEBB7DEF48300F5040AAFA09E6152EB349A558F65

Function 0075A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0075A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0075A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0075A468
CloseHandle.KERNEL32(?), ref: 0075A63D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 49fb00e88d3e66cb24ea3d85d9bedd10df30d1bc6a6037cd988eb96f26e84563
Instruction ID: 5b76c2fdd5220a04bbe4d7147e2f0f6785f7009a9cc21663cc82b71276b17e58
Opcode Fuzzy Hash: 49fb00e88d3e66cb24ea3d85d9bedd10df30d1bc6a6037cd988eb96f26e84563
Instruction Fuzzy Hash: C8A1B071604301AFD760DF24C882F6AB7E6AF84714F14891DF99A9B392D7B4EC44CB86

Function 0073E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0073CF22,?), ref: 0073DDFD

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0073CF22,?), ref: 0073DE16

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

lstrcmpiW.KERNEL32(?,?), ref: 0073E473
MoveFileW.KERNEL32(?,?), ref: 0073E4AC
_wcslen.LIBCMT ref: 0073E5EB
_wcslen.LIBCMT ref: 0073E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0073E650

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 2d7df6fed0f53378a84d9ff7156ea17c4e90b5152516c5bc573669ba4461a812
Instruction ID: 02cbf1f3057567ad04ac310bbafe162ade73db8a0de28b8cde86948f88b225c5
Opcode Fuzzy Hash: 2d7df6fed0f53378a84d9ff7156ea17c4e90b5152516c5bc573669ba4461a812
Instruction Fuzzy Hash: 655185B25083859BD764DB90DC819DF77ED9F84340F00491EF6C9D3192EF78A588876A

Function 0075B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0075BB63
RegCloseKey.ADVAPI32(?,?), ref: 0075BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0075BBB3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6d018a37206ca4c63a0d61ce5841cd133cadbff730644fd2756a29846960f23b
Instruction ID: 600d2c260b09e32b27a6b7555b8650f2cceb2eacb3074690977f666e6f2dee4a
Opcode Fuzzy Hash: 6d018a37206ca4c63a0d61ce5841cd133cadbff730644fd2756a29846960f23b
Instruction Fuzzy Hash: E861C271208241AFD314DF14C890E7ABBE5FF84308F14855DF8994B2A2DB75ED49CB92

Function 00738BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00738BCD
VariantClear.OLEAUT32 ref: 00738C3E
VariantClear.OLEAUT32 ref: 00738C9D
VariantClear.OLEAUT32(?), ref: 00738D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00738D3B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 25e429a72c5b7b9c90e7bd36870cba5aaca216c79db604f05e0c12ef6b1927c7
Instruction ID: be83457bb7a87ba22a21e248b5ec7bf40c83c5ef64bd65d69e4e20c4e7dab463
Opcode Fuzzy Hash: 25e429a72c5b7b9c90e7bd36870cba5aaca216c79db604f05e0c12ef6b1927c7
Instruction Fuzzy Hash: 4A5148B5A00219AFDB10CF68C884AAABBF4FF8D310F158559F915DB350EB34E911CBA1

Function 00748AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00748BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00748BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00748C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00748C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00748C5F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: f5830f3b79acd8ac98ee242273ea0d6e0fb381921b4ec6ea9d14d1acf8dc8e07
Instruction ID: 9635f52530465e3d0e3cafd6b59a35548ab925787677d3e6ba7d22bbe5ff217a
Opcode Fuzzy Hash: f5830f3b79acd8ac98ee242273ea0d6e0fb381921b4ec6ea9d14d1acf8dc8e07
Instruction Fuzzy Hash: 67515D35A002199FCB45DF65C880E6DBBF6FF48314F088499E849AB362DB35ED41CBA5

Function 00758EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00758F40
GetProcAddress.KERNEL32(00000000,?), ref: 00758FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00758FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00759032
FreeLibrary.KERNEL32(00000000), ref: 00759052

Part of subcall function 006EF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00741043,?,753CE610), ref: 006EF6E6
Part of subcall function 006EF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0072FA64,00000000,00000000,?,?,00741043,?,753CE610,?,0072FA64), ref: 006EF70D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 57a9ecce90e01b5e1216616bdd9693d8e421d65a591892b48d37a04d96ba8fe1
Instruction ID: a8a04b439705a8663272b93bcaafbaf0d1b033a4d8add5ab4e450daeb78476a7
Opcode Fuzzy Hash: 57a9ecce90e01b5e1216616bdd9693d8e421d65a591892b48d37a04d96ba8fe1
Instruction Fuzzy Hash: CA514A35A00205DFC745DF54C4948ADBBB1FF49315F088099ED0AAB3A2DB75ED89CB91

Function 00766B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00766C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00766C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00766C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0074AB79,00000000,00000000), ref: 00766C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00766CC7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 2ae6c83b692c4fab29c30d2e5702685eb0ebae28efb1b318aec5671e1f4f9a1c
Instruction ID: 8e2a43304c3b4aca464fda7e4930e3718abd7d3debbe045aa26bf52c66b0b581
Opcode Fuzzy Hash: 2ae6c83b692c4fab29c30d2e5702685eb0ebae28efb1b318aec5671e1f4f9a1c
Instruction Fuzzy Hash: E141E235600504AFD725CF28CC48FA57BA5EB09350F954268EC9AA72A0C379BD40CA64

Function 00702051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007020C3
_free.LIBCMT ref: 007020E3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6c0e1822d327b044fbdbf4d48a394b482efa80c14e2a0fb46491e7511a580de6
Instruction ID: 717a3d38f3b0a76fd539a1934feb05e6fd1f8bc575b02f3d5dfe20c238920c3e
Opcode Fuzzy Hash: 6c0e1822d327b044fbdbf4d48a394b482efa80c14e2a0fb46491e7511a580de6
Instruction Fuzzy Hash: F5419333A00304DFCB24DF78C885A59B7E5EF89314F1546A9E615EB392DA35AD02CB91

Function 006E912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006E9141
ScreenToClient.USER32(00000000,?), ref: 006E915E
GetAsyncKeyState.USER32(00000001), ref: 006E9183
GetAsyncKeyState.USER32(00000002), ref: 006E919D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0eda5e36a253d7be3392cee5c6fe967064d7198722622a1ddbd248f0828bfc85
Instruction ID: 97797849ca386c7e494e2613036b4a0810a48c0de4450d8f71e1b2f226d17847
Opcode Fuzzy Hash: 0eda5e36a253d7be3392cee5c6fe967064d7198722622a1ddbd248f0828bfc85
Instruction Fuzzy Hash: A7416E3190861AFBDF199F65D848BEEB775FF45320F208219E429A6290C7345D50CB61

Function 00743874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 007438CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00743922
TranslateMessage.USER32(?), ref: 0074394B
DispatchMessageW.USER32(?), ref: 00743955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00743966

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 0005dff570550ebaee44bd682dfb8308285f8a00ad567535cd06bb89597ac496
Instruction ID: b0e53533a439444c0e536f4926ee93769234d1a33d9765992d95d730e36d990f
Opcode Fuzzy Hash: 0005dff570550ebaee44bd682dfb8308285f8a00ad567535cd06bb89597ac496
Instruction Fuzzy Hash: AF31D9709043419EFB35CB349C48BB777A8AB46308F54856DD4AAC20A0E3FCB685CB25

Function 0074CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0074CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0074CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFF2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 899fdf64dbcfaabd7714ca9413a719f72776a13ebdcad15b74f0bd5eb0baddd6
Instruction ID: 27fa84bd04711c806bc02e1d4ad49df109c0b73f08f2853845a498e5b947c5cb
Opcode Fuzzy Hash: 899fdf64dbcfaabd7714ca9413a719f72776a13ebdcad15b74f0bd5eb0baddd6
Instruction Fuzzy Hash: 51317C72601305EFDB61DFA5C884AABBBF9EF14310B10842EF546D2101EB78AE459B60

Function 00731901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00731915
PostMessageW.USER32(00000001,00000201,00000001), ref: 007319C1
Sleep.KERNEL32(00000000,?,?,?), ref: 007319C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 007319DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 007319E2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: cceb56a4551262e3719a040504c5f4dc050b1b1d3e4e0923e453078d42f7cb51
Instruction ID: a5c205be8fb9ab9880f33f60ce73bd598c9f5e64d999ffce5ecbab432bc6bfd2
Opcode Fuzzy Hash: cceb56a4551262e3719a040504c5f4dc050b1b1d3e4e0923e453078d42f7cb51
Instruction Fuzzy Hash: 9631F471900259EFDB04CFA8CD99BEE3BB5EB04315F008225F962A72D1C7B4AD54CB90

Function 00765706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00765745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0076579D
_wcslen.LIBCMT ref: 007657AF
_wcslen.LIBCMT ref: 007657BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00765816

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: c56fccd2390b1608f7fd3c59cf3d08263af5de9dd5debd94e180cbc6ee1856e3
Instruction ID: e8bb39a81be21ff17bb14079e961dfb9db618231dd52df418a628665d0e57ac0
Opcode Fuzzy Hash: c56fccd2390b1608f7fd3c59cf3d08263af5de9dd5debd94e180cbc6ee1856e3
Instruction Fuzzy Hash: CF21B671904618DADB218F60CC84EEE7BB8FF04724F108256FD2AEB180DB789985DF54

Function 00750930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00750951
GetForegroundWindow.USER32 ref: 00750968
GetDC.USER32(00000000), ref: 007509A4
GetPixel.GDI32(00000000,?,00000003), ref: 007509B0
ReleaseDC.USER32(00000000,00000003), ref: 007509E8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 70265cd338f37e37eddcc7679fc4e11f12472575aa2801272c9e6592f91a0fa0
Instruction ID: 2fb4971eca20e1512e629438959a9b3dce577d6958720b4a98b43d46169058c9
Opcode Fuzzy Hash: 70265cd338f37e37eddcc7679fc4e11f12472575aa2801272c9e6592f91a0fa0
Instruction Fuzzy Hash: D1216F39A00214AFD704EF69D888AAEBBE5EF44701F04806DE84A97352DBB4AC44CB94

Function 0070CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0070CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0070CDE9

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CE0F
_free.LIBCMT ref: 0070CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0070CE31

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: bc334f34cb0823fc2148986ec011a0f0ab30fc053e480e935293b7c0b2a16d41
Instruction ID: 1d8b40084f448f41674e7b876d3f22ed77bb306853f5ff899252e2e348ffdd65
Opcode Fuzzy Hash: bc334f34cb0823fc2148986ec011a0f0ab30fc053e480e935293b7c0b2a16d41
Instruction Fuzzy Hash: 8701B1B2601215FFA32327B6EC8CC7B79ADDAC6BA1315432DFD05C6281EA688D0191B4

Function 006E9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
SelectObject.GDI32(?,00000000), ref: 006E96A2
BeginPath.GDI32(?), ref: 006E96B9
SelectObject.GDI32(?,00000000), ref: 006E96E2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 46c29ee6f40aae3392edb36b7141924725b29e81600343922eb0383382c791a5
Instruction ID: 6c299a65f9e98662d87077cd5ab1a609d993ca6e2346c04ad1c3d9eb647e117b
Opcode Fuzzy Hash: 46c29ee6f40aae3392edb36b7141924725b29e81600343922eb0383382c791a5
Instruction Fuzzy Hash: AD2183708023C5EBFB119F25EC147EA3B66BF82355F508216F411961B1D3786991CFA9

Function 00735711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00735726
_memcmp.LIBVCRUNTIME ref: 00735744
_memcmp.LIBVCRUNTIME ref: 00735757
_memcmp.LIBVCRUNTIME ref: 0073576F
_memcmp.LIBVCRUNTIME ref: 00735787

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 3f2e4c3d88e27bb5e2191a8f1a103aad459d26c6ac221e37f1ba69efa9c3e274
Instruction ID: 84c72cc5346b14f715b544cfe7a9be39fc60dda1a4d372a90a0027f9fc4f0163
Opcode Fuzzy Hash: 3f2e4c3d88e27bb5e2191a8f1a103aad459d26c6ac221e37f1ba69efa9c3e274
Instruction Fuzzy Hash: 5401B5A2645A09FBF2085520AD92FBB735E9B32394F414024FE099E242FB69ED10C2F4

Function 00702DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6), ref: 00702DFD
_free.LIBCMT ref: 00702E32
_free.LIBCMT ref: 00702E59
SetLastError.KERNEL32(00000000,006D1129), ref: 00702E66
SetLastError.KERNEL32(00000000,006D1129), ref: 00702E6F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e4f7ef0963664a22b3dc2eb0b91ef8cd22e1c1fe56b1f2ea9e8c1035e29cb44f
Instruction ID: 23a8940158230e5a544c661bef658b9bda3e0af1a0b4cbfbac2a79d429bece7a
Opcode Fuzzy Hash: e4f7ef0963664a22b3dc2eb0b91ef8cd22e1c1fe56b1f2ea9e8c1035e29cb44f
Instruction Fuzzy Hash: 9B01F977285600E7C6137735AC4ED2B26DDABD17A57214725F455A22E3EA6C8C034128

Function 0073000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?,?,0073035E), ref: 0073002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?), ref: 00730064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730070

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ad108b04b3712494612fabfd14a396811699769d10f30725add0bfaeb86995a9
Instruction ID: b84704426ecc6dbb9d9d7129f51ee4371e21350b2523666cc00bd2b7fd2cb62b
Opcode Fuzzy Hash: ad108b04b3712494612fabfd14a396811699769d10f30725add0bfaeb86995a9
Instruction Fuzzy Hash: FA01DF76600309BFEB214F68DC48BBA7AADEB44751F108024F846D7211D7B8CD009BA0

Function 007310F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c52cb0ed7f343c6512b2faf2172b676ec72e470ff92063741e0a04a29604aee3
Instruction ID: 751f16a0af8128da62e7db3c9bcc28e4ff0baaa9f0ede3369ee2036e6d6e3743
Opcode Fuzzy Hash: c52cb0ed7f343c6512b2faf2172b676ec72e470ff92063741e0a04a29604aee3
Instruction Fuzzy Hash: F20181B5200309BFEB124F69DC49EAA3F6EEF85360F104414FA86C3350DB75DC008A60

Function 00730FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00730FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00730FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00730FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00730FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00731002

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c0d5c37e8ee2e9bfba0e9ba87dbd487c5b454c2fe7ad603b557ca32c83a549b6
Instruction ID: 08779c8ab0c7360a32ca40ba0f0f60029bda0de70560245c4b9f817a8ac8b736
Opcode Fuzzy Hash: c0d5c37e8ee2e9bfba0e9ba87dbd487c5b454c2fe7ad603b557ca32c83a549b6
Instruction Fuzzy Hash: 66F06275200305FBD7264FA5DC4DF663B6DEF8A761F508414F986D7251CAB9DC408A60

Function 00731014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00731036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731062

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0f81a31bd8689fa68dc575c3425c8eeb05d34f62aca6fce8d24d84c54243a275
Instruction ID: c09f3ef9309ede120a19be1d42a9c14f587dbe8ba1e0c1e8c06833329bc06974
Opcode Fuzzy Hash: 0f81a31bd8689fa68dc575c3425c8eeb05d34f62aca6fce8d24d84c54243a275
Instruction Fuzzy Hash: 2DF0CD75300305FBEB221FA5EC49F663BADEF8A761F104414FA86D7251CAB9DC408A60

Function 0074030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740324
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740331
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 0074033E
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 0074034B
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740358
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740365

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dabc9760f0d1e328b93be0c955742ab23f928549967abec637c6dfb23f06a861
Instruction ID: 3f6611560d59635a3a03326f2c90280cac5449067e5e6fd0d641e1f9ee46be24
Opcode Fuzzy Hash: dabc9760f0d1e328b93be0c955742ab23f928549967abec637c6dfb23f06a861
Instruction Fuzzy Hash: 6001AA72800B159FCB30AF66D890812FBF9BF603153168A3FD29652931C3B5A998CF80

Function 0070D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0070D752

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070D764
_free.LIBCMT ref: 0070D776
_free.LIBCMT ref: 0070D788
_free.LIBCMT ref: 0070D79A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 05bd93dfe6b6ff00b926000bcb69be2d69dab3930f38094c9fab66d70934ceeb
Instruction ID: 9dee420b74a19c28a0cf68e3014b8fe77ed44d2d56ce4267b9c84261ee963315
Opcode Fuzzy Hash: 05bd93dfe6b6ff00b926000bcb69be2d69dab3930f38094c9fab66d70934ceeb
Instruction Fuzzy Hash: 85F0FF33554304EBCA22EBA8F9CAC1677DDBB447107A55A06F048E7592C72CFC818AA4

Function 00735C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00735C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00735C6F
MessageBeep.USER32(00000000), ref: 00735C87
KillTimer.USER32(?,0000040A), ref: 00735CA3
EndDialog.USER32(?,00000001), ref: 00735CBD

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3bca7a120f5d52a3ae6df656f798748299138bd386e0c405c9b45de5af4e31ca
Instruction ID: 08f66dd3112819e6fa22d479486e00b82cf4d3435c09aad6af2cb92688bce8b1
Opcode Fuzzy Hash: 3bca7a120f5d52a3ae6df656f798748299138bd386e0c405c9b45de5af4e31ca
Instruction Fuzzy Hash: CB018630500B05ABFB225B10DD4EFB677B8BB00B05F04655AF5C3A14E1DBF8A984CAA8

Function 007022A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007022BE

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 007022D0
_free.LIBCMT ref: 007022E3
_free.LIBCMT ref: 007022F4
_free.LIBCMT ref: 00702305

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcda286688f572c2476941eec2ee46e91bee4a3a2c3b8cdbb08364ee3692b88e
Instruction ID: 538939280bcdae49d0ffc4aac9c2f3564cc9ef2b9bbf295d0578a20915657fd0
Opcode Fuzzy Hash: fcda286688f572c2476941eec2ee46e91bee4a3a2c3b8cdbb08364ee3692b88e
Instruction Fuzzy Hash: A0F01D76520110CFCA12AF54BC099483AA4B75A750B918607F410E22F2C73C58129EEC

Function 006E95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006E95D4
StrokeAndFillPath.GDI32(?,?,007271F7,00000000,?,?,?), ref: 006E95F0
SelectObject.GDI32(?,00000000), ref: 006E9603
DeleteObject.GDI32 ref: 006E9616
StrokePath.GDI32(?), ref: 006E9631

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 854d9afc285e5aeb5706be3b855f6f29f0a8b6c6dc84535a4e252d34981f427e
Instruction ID: b5ce68a412ee71cd8e1b9f91f7f512db826cc82eeeb8c7a37272f2fdb649e6c5
Opcode Fuzzy Hash: 854d9afc285e5aeb5706be3b855f6f29f0a8b6c6dc84535a4e252d34981f427e
Instruction Fuzzy Hash: 07F08C30006388EBEB165F26EC1C7B63B62AB82322F40C215F466561F0C7789995CF29

Function 00700F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007010F9
__freea.LIBCMT ref: 00701117

Part of subcall function 00701537: _free.LIBCMT ref: 0070154F

Strings

am/pm, xrefs: 0070117A
a/p, xrefs: 007011DE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 8f9228bec59e0be2e21d2c6cf12a834855b76cb223000d622c16db28d5693851
Instruction ID: f59501ca3bff1eb1902d25173fea9d3145c05ce0c0111ec3d89762ef91c33f08
Opcode Fuzzy Hash: 8f9228bec59e0be2e21d2c6cf12a834855b76cb223000d622c16db28d5693851
Instruction Fuzzy Hash: 28D1E231A00206DADB289F68C895BFAB7F5FF06300FA44359E9419BAD1D77D9D80CB91

Function 007561D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 006F0242: EnterCriticalSection.KERNEL32(007A070C,007A1884,?,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F024D
Part of subcall function 006F0242: LeaveCriticalSection.KERNEL32(007A070C,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F028A

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

__Init_thread_footer.LIBCMT ref: 00756238

Part of subcall function 006F01F8: EnterCriticalSection.KERNEL32(007A070C,?,?,006E8747,007A2514), ref: 006F0202
Part of subcall function 006F01F8: LeaveCriticalSection.KERNEL32(007A070C,?,006E8747,007A2514), ref: 006F0235

Part of subcall function 0074359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007435E4
Part of subcall function 0074359C: LoadStringW.USER32(007A2390,?,00000FFF,?), ref: 0074360A

Strings

x#z, xrefs: 0075636F
x#z, xrefs: 0075633A
x#z, xrefs: 00756353

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#z$x#z$x#z
API String ID: 1072379062-95117334
Opcode ID: 5dc0508b062d309553f6fa6fa331366324900ee019eaaaf8febcdb718fe3bcf2
Instruction ID: 8b1edf8fdd13303a947bf98e78c5fdfb1ed04b986ba59170ab6b6999fc18f95c
Opcode Fuzzy Hash: 5dc0508b062d309553f6fa6fa331366324900ee019eaaaf8febcdb718fe3bcf2
Instruction Fuzzy Hash: 03C17C71A00209ABDB14DF58C890EFEB7BAFF49310F508069F9059B251DBB9ED59CB90

Function 00705AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOm, xrefs: 00705BA8, 00705C6C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: JOm
API String ID: 0-3333332779
Opcode ID: cde4c688588551de0a28c681058d18ecc55db013d10646234923373592580bfd
Instruction ID: ec307cee2fc0882e5dbade6ab52665bad6e072e5f87d58178f11db81b096e02d
Opcode Fuzzy Hash: cde4c688588551de0a28c681058d18ecc55db013d10646234923373592580bfd
Instruction Fuzzy Hash: 3451CEB190060AEFDF219FA4C849EBFBBF9AF45314F14025AF405A72D2D6799A01CF61

Function 00708A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00708B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00708B7A
__dosmaperr.LIBCMT ref: 00708B81

Strings

.o, xrefs: 00708A63

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .o
API String ID: 2434981716-1957372423
Opcode ID: 27bc20ebc43ff8967df9d345e5f475be9bad67234389b4f5184bf7201c28b367
Instruction ID: 4b8cc92f4234fc1a2cf0ba61a188741f996c605d07aa566b67c6004a077d3e88
Opcode Fuzzy Hash: 27bc20ebc43ff8967df9d345e5f475be9bad67234389b4f5184bf7201c28b367
Instruction Fuzzy Hash: AF418CF0604155EFCB659F64C880A7D7FE6DF86304B2887A9F4C587682DE398C028795

Function 00732716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007321D0,?,?,00000034,00000800,?,00000034), ref: 0073B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00732760

Part of subcall function 0073B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007321FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0073B3F8

Part of subcall function 0073B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0073B355
Part of subcall function 0073B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00732194,00000034,?,?,00001004,00000000,00000000), ref: 0073B365
Part of subcall function 0073B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00732194,00000034,?,?,00001004,00000000,00000000), ref: 0073B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007327CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0073281A

Strings

@, xrefs: 00732832

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: eac3997c4ef64c4269b5cdeff22c686b0cda9324d02086de95a1065d277f8673
Instruction ID: 0a9c8692b59d17b0ea48739fd9bb4e5d2040e7ad31b27f652f0bceb64923a82b
Opcode Fuzzy Hash: eac3997c4ef64c4269b5cdeff22c686b0cda9324d02086de95a1065d277f8673
Instruction Fuzzy Hash: 19412E76901218BFEB10DFA4CD45AEEBBB8EF09700F104099FA55B7182DB746E45CBA1

Function 0070172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00701769
_free.LIBCMT ref: 00701834
_free.LIBCMT ref: 0070183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00701760, 00701767, 00701796, 007017CE

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 8f219d75a4ff58c022a9be24b0c004762cd65d40b0b89a7f3044198a0faba532
Instruction ID: 6a91dd4f0997c32a4051d17be47ffe5fb5802b1ed42516ec18b0040fd737edcd
Opcode Fuzzy Hash: 8f219d75a4ff58c022a9be24b0c004762cd65d40b0b89a7f3044198a0faba532
Instruction Fuzzy Hash: 93318F75A00218EFDB21DF999885D9EBBFCEB85320F948266F50497291D6B88E40CB90

Function 0073C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0073C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0073C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007A1990,01547758), ref: 0073C395

Strings

0, xrefs: 0073C2DF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 0aed95ff483f9672e61020b49c67e7d57b4b147433279959c10424b1bdf85d69
Instruction ID: 52404b56cc1800c8b4f3a20fb988fd5bce5d133b8ad8112c27d4d6a937269518
Opcode Fuzzy Hash: 0aed95ff483f9672e61020b49c67e7d57b4b147433279959c10424b1bdf85d69
Instruction Fuzzy Hash: 6A41B1312043019FE721DF24D885B2ABBE4AF85310F10861DF9A6A72D2D778E904CB63

Function 00764416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0076CC08,00000000,?,?,?,?), ref: 007644AA
GetWindowLongW.USER32 ref: 007644C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007644D7

Strings

SysTreeView32, xrefs: 0076447C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7708319bc41d90098ebf21d0d9d63f8a695fc6c4473551456fb7d89b8a62e06e
Instruction ID: bbcbfaec3b4b626f7807ba028c04e00a1d52810532d0e072372c81a13214ff0f
Opcode Fuzzy Hash: 7708319bc41d90098ebf21d0d9d63f8a695fc6c4473551456fb7d89b8a62e06e
Instruction Fuzzy Hash: 5231B031210245AFDF218E38DC46BEA7BA9EB09334F204319FD76A21D1DB78EC609B54

Function 00736E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00736EED
VariantCopyInd.OLEAUT32(?,?), ref: 00736F08
VariantClear.OLEAUT32(?), ref: 00736F12

Strings

*js, xrefs: 00736E8B, 00736E90, 00736EF8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *js
API String ID: 2173805711-2626009487
Opcode ID: 0d75b4065e026734700bb5360326a6fc620bdca79412f94b3b0d024d0dbca17e
Instruction ID: 48b268d46495c9335c4d7145dbfba7f0ec4550f085271a6b035fd0b0a9ba48e8
Opcode Fuzzy Hash: 0d75b4065e026734700bb5360326a6fc620bdca79412f94b3b0d024d0dbca17e
Instruction Fuzzy Hash: AE31D371A04246EFDB05AF64E8509BD3776FF40700F108499F8065B3A2CB389911DBD8

Function 0075304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00753077,?,?), ref: 00753378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
_wcslen.LIBCMT ref: 0075309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00753106

Strings

255.255.255.255, xrefs: 00753095, 0075309A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: cfd413a5f80bfbf8e6e48fe0957819c9fc4c5206f30d1741d1fc8c6a4cbcaa3b
Instruction ID: 8bae0f3703246e86e44192611dcd425c063d6304dd19da8dd8a0a0903365b90a
Opcode Fuzzy Hash: cfd413a5f80bfbf8e6e48fe0957819c9fc4c5206f30d1741d1fc8c6a4cbcaa3b
Instruction Fuzzy Hash: 5231D2356007099FCB20CF28C485EAA77E1EF14395F248059EC198B3A2DBBADE49C760

Function 00763EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00763F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00763F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00763F78

Strings

SysMonthCal32, xrefs: 00763F0B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 80b528c0e3da5aa6e5502f9de85e8c3a858023238e0bff1667363824eace3042
Instruction ID: 0c1f0abdf4cac2087437c2dd058cdf8ec8410e90b4d56774efa9a69941095b57
Opcode Fuzzy Hash: 80b528c0e3da5aa6e5502f9de85e8c3a858023238e0bff1667363824eace3042
Instruction Fuzzy Hash: 3B21BF32610219BBEF158F50CC46FEA3B79EB48724F110214FE166B1D0D6B9AD50CBA0

Function 00764653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00764705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00764713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0076471A

Strings

msctls_updown32, xrefs: 00764684

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: d10cfbd617b68d94fc6a4d53ba685a82c9c26ccafe010753bbbc337ba23c418a
Instruction ID: 40424fa5bee75a807e35ada9b944006c78102cbdb22b627ac0217f90d27794e9
Opcode Fuzzy Hash: d10cfbd617b68d94fc6a4d53ba685a82c9c26ccafe010753bbbc337ba23c418a
Instruction Fuzzy Hash: 35216DB5600209AFEB11DF68DCD1DB737ADEF9A3A4B044059FA019B3A1CB74EC51CA64

Function 007395AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073961D

Strings

#OnAutoItStartRegister, xrefs: 007395F3
#requireadmin, xrefs: 007395D9
#notrayicon, xrefs: 007395B7

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 10fd6e4e76172dbc8dde0e21f3b4872aad65aa02ff3276ce76ac2d46623900d8
Instruction ID: bacd86d3e858ff6217c0d82db2bb9a88c992e1bca43e5efbfd00c3a4e5fc0e14
Opcode Fuzzy Hash: 10fd6e4e76172dbc8dde0e21f3b4872aad65aa02ff3276ce76ac2d46623900d8
Instruction Fuzzy Hash: 1A215BB2205610A6E331AB249C03FB773D99F51300F50402AFB4A97183FBD9AD95C2E9

Function 007637B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00763840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00763850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00763876

Strings

Listbox, xrefs: 0076380F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b004571a43074dd32b4e269973127eea57797e16da87a1466730505667b9d28c
Instruction ID: fe75e9871b3483d1eb68118384b131939731943502bf08d5ebff0116ac817b3f
Opcode Fuzzy Hash: b004571a43074dd32b4e269973127eea57797e16da87a1466730505667b9d28c
Instruction Fuzzy Hash: 2421BE72610219BBEF218F54DC85EBB376AEF89760F108124F9069B190C6B9DC52CBA0

Function 007449F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00744A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00744A5C
SetErrorMode.KERNEL32(00000000,?,?,0076CC08), ref: 00744AD0

Strings

%lu, xrefs: 00744A6F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 88736f01990f067338aa17dcad6507fa95d52dec8dbb1bdd453ad98407896521
Instruction ID: 1d7f42c9a69ce4f66b0bef81adf5ff38ef5defd6926affee26270bb8a5724b4b
Opcode Fuzzy Hash: 88736f01990f067338aa17dcad6507fa95d52dec8dbb1bdd453ad98407896521
Instruction Fuzzy Hash: 80318571A00208AFDB51DF54C885EAA77F9EF05304F148099F905DB352DB75ED45CB61

Function 007641EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0076424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00764264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00764271

Strings

msctls_trackbar32, xrefs: 00764226

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 9fe7f0ae9ccfb68a6981fc619dc13063b80447185b742a9ec04703c2eb000e94
Instruction ID: 7bbe609f8ab5cf53e598c2bb5e16c284671f850ee0946b5a394f54dbaeea9766
Opcode Fuzzy Hash: 9fe7f0ae9ccfb68a6981fc619dc13063b80447185b742a9ec04703c2eb000e94
Instruction Fuzzy Hash: 1F110631240208BEEF205F29CC46FAB3BACFF85B64F110114FE56E2090D2B5DC519B14

Function 00732F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Part of subcall function 00732DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00732DC5
Part of subcall function 00732DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00732DD6
Part of subcall function 00732DA7: GetCurrentThreadId.KERNEL32 ref: 00732DDD
Part of subcall function 00732DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00732DE4

GetFocus.USER32 ref: 00732F78

Part of subcall function 00732DEE: GetParent.USER32(00000000), ref: 00732DF9

GetClassNameW.USER32(?,?,00000100), ref: 00732FC3
EnumChildWindows.USER32(?,0073303B), ref: 00732FEB

Strings

%s%d, xrefs: 00732FFF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e0d4445714e65765eae1686e579efbb935125b4d1a08040e2304c7c25f187dfe
Instruction ID: 887d09f186c8bce824e969f4d3c776e8500d7e885fe8050e7939366c038ca45e
Opcode Fuzzy Hash: e0d4445714e65765eae1686e579efbb935125b4d1a08040e2304c7c25f187dfe
Instruction Fuzzy Hash: AD11A271700205ABEF557F60CC89EFD376AAF84304F04807AF9099B253DE7999468B74

Function 00765882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007658C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007658EE
DrawMenuBar.USER32(?), ref: 007658FD

Strings

0, xrefs: 0076588F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 70667782f17265e36008707e9d2275eca05ede4c69e58c3dfde9dc17bda4ed82
Instruction ID: bb8d798c7b42eb1189047f17ec5f305e0f0b15b759f413a5ea120edbeda8dd64
Opcode Fuzzy Hash: 70667782f17265e36008707e9d2275eca05ede4c69e58c3dfde9dc17bda4ed82
Instruction Fuzzy Hash: 02018B31500348EFDB219F11DC44BAEBBB5FB45360F108099E88AD6151DB74AA94EF24

Function 0073007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8253753b864a3daf44eb555188ef87f633ac7682bed257e6c910e5f3f7479465
Instruction ID: cdca53d831ec80b7a9a20f072e284b40d4f6bed1f333797430e0f4dfafa3a108
Opcode Fuzzy Hash: 8253753b864a3daf44eb555188ef87f633ac7682bed257e6c910e5f3f7479465
Instruction Fuzzy Hash: 93C17C75A0020AEFEB14CFA4C8A8EAEB7B5FF48714F108598E505EB252D735ED41DB90

Function 0075342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00753459
CoUninitialize.OLE32 ref: 00753463
VariantInit.OLEAUT32(?), ref: 0075346E
VariantClear.OLEAUT32(?), ref: 0075371B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 1b81984551458aa7e8d31d68df3e55cb3ad57237c1572a201ef9393acf8536cc
Instruction ID: ab110ab4ba726a20137004dbefb56dde8aaae6da419b3913df00796c443cd1d3
Opcode Fuzzy Hash: 1b81984551458aa7e8d31d68df3e55cb3ad57237c1572a201ef9393acf8536cc
Instruction Fuzzy Hash: 32A156756042009FC700DF28C485A6AB7E6EF88351F04895DFD8A9B362EB74EE05CB96

Function 00730436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0076FC08,?), ref: 007305F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0076FC08,?), ref: 00730608
CLSIDFromProgID.OLE32(?,?,00000000,0076CC40,000000FF,?,00000000,00000800,00000000,?,0076FC08,?), ref: 0073062D
_memcmp.LIBVCRUNTIME ref: 0073064E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 51b789e23a84144422b5f9bab7c606f772b1a5cbeae1182c56737177ce12baba
Instruction ID: 14643ad8cec9f014846410a42d0494bb1c4970297969af7c41aacff3403e02b6
Opcode Fuzzy Hash: 51b789e23a84144422b5f9bab7c606f772b1a5cbeae1182c56737177ce12baba
Instruction Fuzzy Hash: 7B815C71A00109EFDB04DF94C994EEEB7B9FF89315F204198F506AB251DB75AE06CBA0

Function 00711391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007114C0

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ac7449862de37793cccf28df96c29ee6b0aad95c3aecc1afc115ba5fd4e0f20b
Instruction ID: 9ded31d98f96b9f742e07b3129599e4eab34caeb44a677261bc3a00c9c359610
Opcode Fuzzy Hash: ac7449862de37793cccf28df96c29ee6b0aad95c3aecc1afc115ba5fd4e0f20b
Instruction Fuzzy Hash: 56415C31600144EBDB216BFC8C4AAFE3AE6EF41770F544225FF19DA1D2E63C89819762

Function 00766278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007662E2
ScreenToClient.USER32(?,?), ref: 00766315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00766382

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f6bf5943e4a54002916e905dc0ee04c00ab54ede5f30f7929b8415f10dcb7526
Instruction ID: 64facde40cee0d18254da372a64f90f244da86788e41b0d8d4ce4715fa12eab9
Opcode Fuzzy Hash: f6bf5943e4a54002916e905dc0ee04c00ab54ede5f30f7929b8415f10dcb7526
Instruction Fuzzy Hash: 6D513A74A00249EFDF10DF69D8809AE7BB6FF85360F50815AF9169B290D734ED81CB50

Function 00751AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00751AFD
WSAGetLastError.WSOCK32 ref: 00751B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00751B8A
WSAGetLastError.WSOCK32 ref: 00751B94

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: ad3b0f5c909d3c1e1f100733a746601fd1c737184abaafb267c9ac0fdb7eec95
Instruction ID: 974422cc96980774a948dfe48d44aac70c5fddf3f9d891e5f38b70e175fb0813
Opcode Fuzzy Hash: ad3b0f5c909d3c1e1f100733a746601fd1c737184abaafb267c9ac0fdb7eec95
Instruction Fuzzy Hash: 8A41B074600300AFE720AF24C886F6977E6AB44719F94844CF95A9F3D2D7B6DD41CB94

Function 0070B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75bd3f182b5957677229351e99e0d151c9eae01ddabc56e3d296ac9727fda2b
Instruction ID: 17a4a0bf45e9cb12e9dbdb3e74fc3dfbb8614981e19d07e14129025cefb7a297
Opcode Fuzzy Hash: a75bd3f182b5957677229351e99e0d151c9eae01ddabc56e3d296ac9727fda2b
Instruction Fuzzy Hash: 3241E672A00344EFD7249F78CC45BAABBE9EF88710F10466AF145DB2C2D779AB418780

Function 007456D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00745783
GetLastError.KERNEL32(?,00000000), ref: 007457A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007457CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007457FA

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e4db08bf0b2bc42a7938af6c4ff62fc4d237c67751838d6469f675acbbfd2f1d
Instruction ID: 19d179772c79151587568ab2db40ac119efc8d2c874f9c7610a2558297df6b0c
Opcode Fuzzy Hash: e4db08bf0b2bc42a7938af6c4ff62fc4d237c67751838d6469f675acbbfd2f1d
Instruction Fuzzy Hash: 1F413B39600611DFCB11EF15C444A5EBBE2EF89720B19C489EC4AAB362DB34FD00CB96

Function 0070D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,006F6D71,00000000,00000000,006F82D9,?,006F82D9,?,00000001,006F6D71,?,00000001,006F82D9,006F82D9), ref: 0070D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0070D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0070D9AB
__freea.LIBCMT ref: 0070D9B4

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b476851f3a4df5968cb5d86068522fa21d12f590d995bad01b374c44a84a9b51
Instruction ID: c1b40e17bcf029e3c4a033e22c42b00e08f0d2232240b6c3c6f0f950d9e275fc
Opcode Fuzzy Hash: b476851f3a4df5968cb5d86068522fa21d12f590d995bad01b374c44a84a9b51
Instruction Fuzzy Hash: 9931AB72A1020AEBDF25DFA5DC45EAE7BE5EB41310B054268FC05D6291EB39ED50CBA0

Function 007652C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00765352
GetWindowLongW.USER32(?,000000F0), ref: 00765375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00765382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007653A8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: c830634590ab639b2e6a12a51eafe71ae96d4850040d1802024a1102fca038ce
Instruction ID: 74a88d587b45ce700f330a99fcbc8322841d25d23700ca04147ccd12ebafb0dd
Opcode Fuzzy Hash: c830634590ab639b2e6a12a51eafe71ae96d4850040d1802024a1102fca038ce
Instruction Fuzzy Hash: ED31D234A55A08EFEB309E16CC05BE93761AB05B98F584102FE13963E1C7BC9D40FB45

Function 0073AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0073ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0073AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0073AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0073ACC6

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b12347610f4bfd827f86380e5de31e703913f6a021e043e15321e306ae1e54c6
Instruction ID: 4b7b3b1ac9315c5ddcbe1a6d3e6fb4fa1a44309f0cfef13c5712f65b20f4a8fd
Opcode Fuzzy Hash: b12347610f4bfd827f86380e5de31e703913f6a021e043e15321e306ae1e54c6
Instruction Fuzzy Hash: EF311631A44318BFFB258B65CC0A7FABBA5AB45310F08621AE4C1521D2C37D8D818776

Function 00767674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0076769A
GetWindowRect.USER32(?,?), ref: 00767710
PtInRect.USER32(?,?,00768B89), ref: 00767720
MessageBeep.USER32(00000000), ref: 0076778C

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a71a00106a43d1d5bf74f2ca9466bbef521f587560e85d651f8a231fb5b32f29
Instruction ID: a162db6af1d08b6b5ce15c8300c3bf2b3e68ffba855fc64720179607831c32cf
Opcode Fuzzy Hash: a71a00106a43d1d5bf74f2ca9466bbef521f587560e85d651f8a231fb5b32f29
Instruction Fuzzy Hash: A441BF34605254DFDB09CF58C894EA977F4FF49398F5580A8E8169B261D738E941CF90

Function 007616DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007616EB

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

GetCaretPos.USER32(?), ref: 007616FF
ClientToScreen.USER32(00000000,?), ref: 0076174C
GetForegroundWindow.USER32 ref: 00761752

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 3708eba034757c44ff94988e3667f076601aa2e5a7953d5bec0c509cc885c0c4
Instruction ID: daa5d4ddb4cd0e98bb9d438c3849bb0efcdea4d948975f3828bb52b710f76e9b
Opcode Fuzzy Hash: 3708eba034757c44ff94988e3667f076601aa2e5a7953d5bec0c509cc885c0c4
Instruction Fuzzy Hash: 50314371D00249AFD700DFA9C885CAEBBF9EF48314B5480AAE456E7312D7359E45CBA0

Function 0073D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Process32NextW.KERNEL32(00000000,?), ref: 0073D52F
CloseHandle.KERNEL32(00000000), ref: 0073D5DC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction ID: a6705e946702535b3b589dc34347f29cdf0d0865955024380f33c3964bd5147c
Opcode Fuzzy Hash: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction Fuzzy Hash: BF31E4721083009FD315EF50D881ABFBBF8EF99344F04082DF582872A2EB719944CBA2

Function 00768FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

GetCursorPos.USER32(?), ref: 00769001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00727711,?,?,?,?,?), ref: 00769016
GetCursorPos.USER32(?), ref: 0076905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00727711,?,?,?), ref: 00769094

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 89452f109dace545edf0aaaf14b86acc4c653e3f025a7b6f1fbeb5b78be43775
Instruction ID: 42322d9f4060f75f7cb753a9703aad57fee122301175975b43085c22a8a33ad6
Opcode Fuzzy Hash: 89452f109dace545edf0aaaf14b86acc4c653e3f025a7b6f1fbeb5b78be43775
Instruction Fuzzy Hash: 0221A135601118EFDF268F94CC58EFA7BB9EF8A360F148069FA0647261C379AD50DB60

Function 0073D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0076CB68), ref: 0073D2FB
GetLastError.KERNEL32 ref: 0073D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0073D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0076CB68), ref: 0073D376

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 225abcbbdc2030aa6ddf257f7428573f7ff43848e0b58b3e25f34a44932552f1
Instruction ID: 878eefa10e6a3ecdeadd05a7361d48b38d0ccacd56b901c7cf7f31ca1995fcde
Opcode Fuzzy Hash: 225abcbbdc2030aa6ddf257f7428573f7ff43848e0b58b3e25f34a44932552f1
Instruction Fuzzy Hash: 7D21A370509301DF9320DF24E88186A77E4FE56724F104A1EF499C32A2D735DD49CB97

Function 00731571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00731014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073102A
Part of subcall function 00731014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00731036
Part of subcall function 00731014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731045
Part of subcall function 00731014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073104C
Part of subcall function 00731014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007315BE
_memcmp.LIBVCRUNTIME ref: 007315E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00731617
HeapFree.KERNEL32(00000000), ref: 0073161E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e39eb74af27895508a79b03d8b62a272bf241ba2e86824a1694ca0fc9aca2741
Instruction ID: b04a88705c8f971b707be0a36532bd669d936042aafd38777e25c0660ca693b4
Opcode Fuzzy Hash: e39eb74af27895508a79b03d8b62a272bf241ba2e86824a1694ca0fc9aca2741
Instruction Fuzzy Hash: A421A171E00209EFEF04DFA5C945BEEB7B8EF44344F498459E441AB242EB78AE05CB60

Function 00762782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0076280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00762824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00762832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00762840

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 85aa0359f33f6dd4dcc30c12bf14b49c4e79833f9ec2a2d333b76a379ce5150c
Instruction ID: 512d26a49b99b3d5c2c09ffc3dcf6a11aaee83edc54614cd0a3f339f6907a3eb
Opcode Fuzzy Hash: 85aa0359f33f6dd4dcc30c12bf14b49c4e79833f9ec2a2d333b76a379ce5150c
Instruction Fuzzy Hash: 8D21F131204A12AFD7549B24CC44FAA7B95AF85324F248159F8278B6E3CBB9FC42C7D0

Function 007378F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00738D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0073790A,?,000000FF,?,00738754,00000000,?,0000001C,?,?), ref: 00738D8C
Part of subcall function 00738D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00738DB2
Part of subcall function 00738D7D: lstrcmpiW.KERNEL32(00000000,?,0073790A,?,000000FF,?,00738754,00000000,?,0000001C,?,?), ref: 00738DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00738754,00000000,?,0000001C,?,?,00000000), ref: 00737923
lstrcpyW.KERNEL32(00000000,?), ref: 00737949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00738754,00000000,?,0000001C,?,?,00000000), ref: 00737984

Strings

cdecl, xrefs: 0073797B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 37a95a5221c594eb7f759bc92ec317f3e4cf364480d4f2b83cb081549d1993a4
Instruction ID: 14a86e7195db0197063286ea3d7b59390e413b2559c596c719f51e4e03714405
Opcode Fuzzy Hash: 37a95a5221c594eb7f759bc92ec317f3e4cf364480d4f2b83cb081549d1993a4
Instruction Fuzzy Hash: 8011297A200341ABDB295F35D844E7A77A9FF45350F00812AF842C7265EF79E801C755

Function 00767CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00767D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00767D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00767D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0074B7AD,00000000), ref: 00767D6B

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: ac9b4bd899e38768e1691f57cd78cf1cbb4e28e4d743d6ba9ec7fe543e57dd47
Instruction ID: 261c1e267edd317134de87e0b99674c1aa77635d2860fc5a22cfe87e1a4bc467
Opcode Fuzzy Hash: ac9b4bd899e38768e1691f57cd78cf1cbb4e28e4d743d6ba9ec7fe543e57dd47
Instruction Fuzzy Hash: B811D231204654AFDB149F28CC04A7A3BA5AF863A4F218B24FC37CB2F0E7389950DB54

Function 00765660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 007656BB
_wcslen.LIBCMT ref: 007656CD
_wcslen.LIBCMT ref: 007656D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00765816

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 5e22cd5e624771397ea6e71fd5f6cc09b6199d8e32833313fc1122a338951d44
Instruction ID: 153c91954f252fac200f35e40e8631235ed6b0233978e00d847452b50e385052
Opcode Fuzzy Hash: 5e22cd5e624771397ea6e71fd5f6cc09b6199d8e32833313fc1122a338951d44
Instruction Fuzzy Hash: 5211E17160060996DB209F61CC85AFE3BACAF01764F10806AFD17D6081EBB89A84DB64

Function 00701D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc2edf4f7271ff5e7bb50742b493c83394c855627dc66169b62980443ade911
Instruction ID: d88cb72d209d3ef0a21ec0470585e83705fb429ebd4da045ff2e255131fe7694
Opcode Fuzzy Hash: 0cc2edf4f7271ff5e7bb50742b493c83394c855627dc66169b62980443ade911
Instruction Fuzzy Hash: 8E01D1F230961AFEF62166B86CC4F27669CEF823B8F750325F521A11D2EB689C005270

Function 00731A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00731A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A8A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0db5bc7ef365c4fad75e4cb9fd8c47b971479fc893a3b5432b5674b07656fa5d
Instruction ID: d050dc0bcc666ff71ba6bbf5a2e7fcef58be7df571c5bca149093995f2db31e4
Opcode Fuzzy Hash: 0db5bc7ef365c4fad75e4cb9fd8c47b971479fc893a3b5432b5674b07656fa5d
Instruction Fuzzy Hash: 4E11393AD01219FFEB11DBA4CD85FADBB78EB08750F204091EA00B7290D6716E50DB94

Function 0073E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0073E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0073E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0073E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0073E24D

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3cdd76d3918cf4967e0559cc67001307065ecfb3bfe60055ff384b841d1ed345
Instruction ID: 19fcc23b3707f97169b35283579863d0f19f3a942641416533e8f0b128019990
Opcode Fuzzy Hash: 3cdd76d3918cf4967e0559cc67001307065ecfb3bfe60055ff384b841d1ed345
Instruction Fuzzy Hash: 78112BB2904358BBEB019FA89C05AAF7FADAB86310F008215F915E32D1D2B8DD0087A4

Function 006FD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,006FCFF9,00000000,00000004,00000000), ref: 006FD218
GetLastError.KERNEL32 ref: 006FD224
__dosmaperr.LIBCMT ref: 006FD22B
ResumeThread.KERNEL32(00000000), ref: 006FD249

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 18c29ec41e2b1c2b9558a353b4b7d650681d0864a2681444ed1ce36b993396d3
Instruction ID: 89abd207151a9ce25d1bdd8af35620376d0c5e7fa719c8a31b5a77eac05ba926
Opcode Fuzzy Hash: 18c29ec41e2b1c2b9558a353b4b7d650681d0864a2681444ed1ce36b993396d3
Instruction Fuzzy Hash: 4501D63640520CBBDB125BA5DC09BBE7A6BEF82331F104219FB25922D0CB719A01C6E1

Function 00769EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

GetClientRect.USER32(?,?), ref: 00769F31
GetCursorPos.USER32(?), ref: 00769F3B
ScreenToClient.USER32(?,?), ref: 00769F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00769F7A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 820d18dcaa7ffede059eb5f7c1f7ececd6940a9244a4595ad749f53996588618
Instruction ID: fc03cdd3f0f95eee52e9eb70c23aec6081dff1cc6babda5265afd122e92ae08e
Opcode Fuzzy Hash: 820d18dcaa7ffede059eb5f7c1f7ececd6940a9244a4595ad749f53996588618
Instruction Fuzzy Hash: 3C11853290021AEBDB01DFA8C8899FE77BCFB45311F418455FA02E3040C378BA81CBA5

Function 006D600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
GetStockObject.GDI32(00000011), ref: 006D6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 2691cad14fcc98602785e7ca5b2b84be93d426f270ea6095a6835f482d173d9e
Instruction ID: 311bf313fd1fbb70a29bc3158dc5b6c022eb23ce523022bc88addb69fbcd9bf0
Opcode Fuzzy Hash: 2691cad14fcc98602785e7ca5b2b84be93d426f270ea6095a6835f482d173d9e
Instruction Fuzzy Hash: CE11C472901608BFEF125F94CD44EFA7B6AFF09354F004102FA1552210C776DC60DB90

Function 006F3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 006F3B56

Part of subcall function 006F3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 006F3AD2
Part of subcall function 006F3AA3: ___AdjustPointer.LIBCMT ref: 006F3AED

_UnwindNestedFrames.LIBCMT ref: 006F3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 006F3B7C
CallCatchBlock.LIBVCRUNTIME ref: 006F3BA4

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 1f596bf0503ba011754e39673dc30443a8c496877176a61627e2c481316bb0f5
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: EF01293210014DBBDF125E95CC42EFB3B6AEF99754F044019FF5866221CB32E961DBA4

Function 00703073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006D13C6,00000000,00000000,?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue), ref: 007030A5
GetLastError.KERNEL32(?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue,00772290,FlsSetValue,00000000,00000364,?,00702E46), ref: 007030B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue,00772290,FlsSetValue,00000000), ref: 007030BF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: aad9eb118b77bf40716785dee58b8cb55596121608d2526cf6530c027459d107
Instruction ID: 2b42031dc542b7c6846ea2d4c28435796d8e55af83550e18ab474f641d35d76e
Opcode Fuzzy Hash: aad9eb118b77bf40716785dee58b8cb55596121608d2526cf6530c027459d107
Instruction Fuzzy Hash: 8B01F732312326EBCB324B799C459677BDEAF45BA1B108720F94AE31C0D729D901C6E4

Function 00737464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0073747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00737497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007374AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 007374CA

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: c1934e0217c948e4999e4b9768f26eec37a66062bb1d9a9e2959997a72cdaae6
Instruction ID: 0df0b1a4cbc62c3d0eaf68b4a8e7a94822fa9f27aa2c58e5d4e4e60e8b35620c
Opcode Fuzzy Hash: c1934e0217c948e4999e4b9768f26eec37a66062bb1d9a9e2959997a72cdaae6
Instruction Fuzzy Hash: 8D117CF12053949BF7348F54EC08BA27FF8EB00B10F108569A656D6552D7B8F904DB50

Function 0073B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B126

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3d15ceefd3109e122ef3687befabfb1fe61d184c39182a819dba6e2a2adf8496
Instruction ID: 2f319ecfdd969ad27f082ba8a7f9ea8a07068a593a9cf16dd9c20f6db508d642
Opcode Fuzzy Hash: 3d15ceefd3109e122ef3687befabfb1fe61d184c39182a819dba6e2a2adf8496
Instruction Fuzzy Hash: BC116171C0161CD7DF04AFE4D9596FEBB78FF0A711F108089DA81B6146CB7895508B55

Function 00767E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00767E33
ScreenToClient.USER32(?,?), ref: 00767E4B
ScreenToClient.USER32(?,?), ref: 00767E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00767E8A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: ba2d467fd4d6254797e49d2144e142c30a990bb2de02ef1240bd1d45f8044927
Instruction ID: f34cf39198c53d7dceccf67ae14ede4956d65f30bf6658040e1071dd74be1294
Opcode Fuzzy Hash: ba2d467fd4d6254797e49d2144e142c30a990bb2de02ef1240bd1d45f8044927
Instruction Fuzzy Hash: C71153B9D0024AAFDB41CF98C884AEEBBF9FF08310F509066E955E3210D775AA54CF94

Function 00732DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00732DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00732DD6
GetCurrentThreadId.KERNEL32 ref: 00732DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00732DE4

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b993afd267a88bedeba8cca67a3d790eca0ed482edef7e4405f90724afe940d8
Instruction ID: b45706a92af35b061271b0568ed4a8dac37550603f0354d57cce51ab442cff39
Opcode Fuzzy Hash: b993afd267a88bedeba8cca67a3d790eca0ed482edef7e4405f90724afe940d8
Instruction Fuzzy Hash: DAE06D722013247AEB212B62DC0EEFB7E6CEF42BA1F004015F107D10829AE98841C6B5

Function 00768863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 006E9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96A2
Part of subcall function 006E9639: BeginPath.GDI32(?), ref: 006E96B9
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00768887
LineTo.GDI32(?,?,?), ref: 00768894
EndPath.GDI32(?), ref: 007688A4
StrokePath.GDI32(?), ref: 007688B2

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 959e9c5038c6a7227cecffa0efc5bc3393c7c477a74b4fd4e36d47a36259dd4b
Instruction ID: 2cc1c18390d1a5f86a6780f14cf707a2d8e2c9bd0bd4d9128a5efd4c13719e00
Opcode Fuzzy Hash: 959e9c5038c6a7227cecffa0efc5bc3393c7c477a74b4fd4e36d47a36259dd4b
Instruction Fuzzy Hash: D6F03A36041259BAEB136F94AC09FDA3F59AF4A310F44C100FA52651E1C7B95511CFAA

Function 006E98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 006E98CC
SetTextColor.GDI32(?,?), ref: 006E98D6
SetBkMode.GDI32(?,00000001), ref: 006E98E9
GetStockObject.GDI32(00000005), ref: 006E98F1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: ffa1bd225921eef9bd2fc7271c5113f43289d53a282c626531e10fc8aaf937f0
Instruction ID: bf5f8d2a2da00ac26fa1ac98fa342632d882705ae41aa398280c76ccfd119ccd
Opcode Fuzzy Hash: ffa1bd225921eef9bd2fc7271c5113f43289d53a282c626531e10fc8aaf937f0
Instruction Fuzzy Hash: 01E06531244384AADB225B75FC09BE93F11AB12335F14C219F6FB540E1C3B94650DB11

Function 0073162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00731634
OpenThreadToken.ADVAPI32(00000000,?,?,?,007311D9), ref: 0073163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007311D9), ref: 00731648
OpenProcessToken.ADVAPI32(00000000,?,?,?,007311D9), ref: 0073164F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e06761637a89cdd6dae6d644487237d8eedb1ed8b055ec0b8170b1c2b4863934
Instruction ID: b47e7c0917eca463b06563f46de632ec65e75d4311e549d7f9321fe0fb387975
Opcode Fuzzy Hash: e06761637a89cdd6dae6d644487237d8eedb1ed8b055ec0b8170b1c2b4863934
Instruction Fuzzy Hash: EEE08671601311EBE7201FE19E0DB663B7CAF44791F14C808F686D9080DABC4440C758

Function 0072D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0072D858
GetDC.USER32(00000000), ref: 0072D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0072D882
ReleaseDC.USER32(?), ref: 0072D8A3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 46fd10555ce78d5e5ca6f0be6f1f1b253eb038102eda950e347686c8d331e0d1
Instruction ID: a1e015248ba213f0ff686f7f09f9ad729269b6c2fb46886580e93bc2a68491f4
Opcode Fuzzy Hash: 46fd10555ce78d5e5ca6f0be6f1f1b253eb038102eda950e347686c8d331e0d1
Instruction Fuzzy Hash: F3E01AB5800305DFCB429FA0D808A7DBBB2FB08310F14D009E88BE7250C7BC9941AF48

Function 0072D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0072D86C
GetDC.USER32(00000000), ref: 0072D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0072D882
ReleaseDC.USER32(?), ref: 0072D8A3

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8c30af589b94cf18ec6c2596215f439f906e7d8749e10eccf5c2566d2759a9b5
Instruction ID: b9fbc5aad1b9bdf5ef9f001c47bd890f516d206e9e9ccb70df9fd0237e653fe8
Opcode Fuzzy Hash: 8c30af589b94cf18ec6c2596215f439f906e7d8749e10eccf5c2566d2759a9b5
Instruction Fuzzy Hash: 02E01A70C00304DFCB429FA0D80866DBBB2FB08310B149009E98AE7250C7BC59019F48

Function 00744D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00744ED4

Strings

LPT, xrefs: 00744DFB
*, xrefs: 00744E10

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 2fe2dd7ea55013b175c55b08629b5db9b9d60c226174c56f2cebb32f9637eed5
Instruction ID: ee6ea3af779c17143d1bd9e330c6f207bb9ee584a19bd1a47bffd699da79edb8
Opcode Fuzzy Hash: 2fe2dd7ea55013b175c55b08629b5db9b9d60c226174c56f2cebb32f9637eed5
Instruction Fuzzy Hash: 94914D75A002549FDB14DF58C484FAABBF1BF44304F198099E80A9F3A2D739EE85DB91

Function 006FE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 006FE30D

Strings

pow, xrefs: 006FE2E5, 006FE302

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 61f2918f78fda8e89f3b0b8533bb6bef6d9bed4d80cdb0a699bb1386582b05b7
Instruction ID: 371103b728a2f21d417ef0e81c70ab25b47023b6654cd762aaa359784fc5a827
Opcode Fuzzy Hash: 61f2918f78fda8e89f3b0b8533bb6bef6d9bed4d80cdb0a699bb1386582b05b7
Instruction Fuzzy Hash: 8D519C62E0C206D6CB197B14C9453BA3FD5AB40780F308A58E1D5463F9EB3E9CD2DA46

Function 00757771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0072569E,00000000,?,0076CC08,?,00000000,00000000), ref: 007578DD

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

CharUpperBuffW.USER32(0072569E,00000000,?,0076CC08,00000000,?,00000000,00000000), ref: 0075783B

Strings

<sy, xrefs: 007577C8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sy
API String ID: 3544283678-4294649419
Opcode ID: e6ce49ea6553748ae704feb61330eb95e781dfb88cb6bcfb8d6e012bfa0d0563
Instruction ID: 9ffc1710135f06a075a9cf6980cd7a11bb6445158324f7e8b8c3132c5d0309ba
Opcode Fuzzy Hash: e6ce49ea6553748ae704feb61330eb95e781dfb88cb6bcfb8d6e012bfa0d0563
Instruction Fuzzy Hash: BB618371D141189BCF48EBE0DC91DFDB375BF14301B44452AF942A7291EF786A09DBA4

Function 006EE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 006EE1B1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 70851b8fa76224614c850ed6cc6ea9ad273b88fb738ee0a47d6ecad1fa6e5eeb
Instruction ID: 5e8112ec98d61a462b2bdbb46215fc54cda045109d30ecbbd29a8a1ef2388a89
Opcode Fuzzy Hash: 70851b8fa76224614c850ed6cc6ea9ad273b88fb738ee0a47d6ecad1fa6e5eeb
Instruction Fuzzy Hash: 45514335A01396DFDB15DF69D0816FA7BAAEF15310F248059E8919B3C0DB399E43CBA0

Function 006EF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 006EF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 006EF2BB

Strings

@, xrefs: 006EF2AF

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9aa994e7cfe10a609439a920ce03e55d6472ace42a2e266f89344b50ffbaf49d
Instruction ID: 195248a5a8836f5fa29b98a90af3299b0432ef810a9389e6e1e61dd40b97c019
Opcode Fuzzy Hash: 9aa994e7cfe10a609439a920ce03e55d6472ace42a2e266f89344b50ffbaf49d
Instruction Fuzzy Hash: 0B5158718087499BD360AF10DC86BABBBF9FF84310F91884DF1D981195EB709529CB6B

Function 00755745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 007557E0
_wcslen.LIBCMT ref: 007557EC

Strings

CALLARGARRAY, xrefs: 007557E6, 007557EB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: da6075b043dd74634169196be4b16a6a0b39eee7835684c34696fde795b63997
Instruction ID: fa7da8ce989b906a3eff5fcb515edae7df93156e5fd6fbbf7140e495702f836f
Opcode Fuzzy Hash: da6075b043dd74634169196be4b16a6a0b39eee7835684c34696fde795b63997
Instruction Fuzzy Hash: D6419F31E00209DFCB14DFA9C8959FEBBB5EF59311F10402DE905A7251E7B9AD85CBA0

Function 0074D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0074D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0074D13A

Strings

|, xrefs: 0074D10B

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: a465e94310c23077c28105d607f8b93dd37bac1d089417086656fe9248bd2cf8
Instruction ID: e59fd2e0ac6a2cf8cec74010fba208d9631ebaecb1b8c1c259c371b053f00249
Opcode Fuzzy Hash: a465e94310c23077c28105d607f8b93dd37bac1d089417086656fe9248bd2cf8
Instruction Fuzzy Hash: 4A313D75D00209ABCF55EFA4CC85AEE7FBAFF04304F00001EF915A6265EB35AA06DB64

Function 0076356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00763621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0076365C

Strings

static, xrefs: 007635BC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 7b60793f077a58f4d3b9e3c21a908c223932eb67028d24e5cc6e376ff8512e19
Instruction ID: 0b018369fd3b9a489186bb0b1438f142749cebde83e9bbb639f7de2853470b09
Opcode Fuzzy Hash: 7b60793f077a58f4d3b9e3c21a908c223932eb67028d24e5cc6e376ff8512e19
Instruction Fuzzy Hash: D6318F71100204AAEB109F78DC40EFB73A9FF88724F00961DFDA697290DA78AD91C764

Function 00764537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0076461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00764634

Strings

', xrefs: 0076458E

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: ab699a260db84c5bb369bb4190484bc0103a0ae4a289b47af5b896dcc71c7fd0
Instruction ID: 72c942bbd99c6debff109d02880331025b851ce6089effceb8528f1a1fad5da1
Opcode Fuzzy Hash: ab699a260db84c5bb369bb4190484bc0103a0ae4a289b47af5b896dcc71c7fd0
Instruction Fuzzy Hash: 38312774A0120A9FDF14CFA9C980BDA7BB5FF49300F14406AED06AB342D774A951CF90

Function 007631EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0076327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00763287

Strings

Combobox, xrefs: 00763249

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 7af11ecf8bb60870da8cc17cd972c3026f2ddf3e5915b2f50e469d35d4754fc3
Instruction ID: 997092defedd7166d6c326abea698cf3df1a7257746bfd621fad275c15de15f4
Opcode Fuzzy Hash: 7af11ecf8bb60870da8cc17cd972c3026f2ddf3e5915b2f50e469d35d4754fc3
Instruction Fuzzy Hash: 6D11E271300208BFFF25DE54DC90EBB37AAFB943A4F104128F91A97290D6799D51C760

Function 00763710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 006D600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
Part of subcall function 006D600E: GetStockObject.GDI32(00000011), ref: 006D6060
Part of subcall function 006D600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

GetWindowRect.USER32(00000000,?), ref: 0076377A
GetSysColor.USER32(00000012), ref: 00763794

Strings

static, xrefs: 00763757

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 03b58c3129f5cc7066945cc0bc8f5d78177e02a807bc320969db50b7de55f22b
Instruction ID: 2c7ec7d799701aa0b904c0064bc4e49e8059ed111dbd1e3e19ce8f9e2161f1b1
Opcode Fuzzy Hash: 03b58c3129f5cc7066945cc0bc8f5d78177e02a807bc320969db50b7de55f22b
Instruction Fuzzy Hash: 301129B2610209AFDB01DFA8CC45AFA7BB8EB09354F004515FD56E2250D779E851DB50

Function 0074CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0074CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0074CDA6

Strings

<local>, xrefs: 0074CD66

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 34323b5b75b6ce3f73b590345d31a23327883da23e3e426dc5bc9ab067ad6a41
Instruction ID: dbab2b53fac9e62d10b9ed610a221f4dba34d8bb70a7981863a5ebe6da7a048e
Opcode Fuzzy Hash: 34323b5b75b6ce3f73b590345d31a23327883da23e3e426dc5bc9ab067ad6a41
Instruction Fuzzy Hash: 4A11C671B066357AD77A4B668C45EF7BE6CEF127A4F004226B15983190D7789840DAF0

Function 00763429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007634AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007634BA

Strings

edit, xrefs: 0076348F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 559d64c93edb163c6a708ed535b0a48eb677e41e237ca7eb311fac5ad25c8fe7
Instruction ID: 9fb7c6079535bb392dd25087fbc61fb171528b6c80150ee07aec7863c1f1da1e
Opcode Fuzzy Hash: 559d64c93edb163c6a708ed535b0a48eb677e41e237ca7eb311fac5ad25c8fe7
Instruction Fuzzy Hash: 67118F71500248ABEB128E64DC44ABB7B6AEF05374F504324FD62931E0CB79DC55D754

Function 00736C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00736CB6
_wcslen.LIBCMT ref: 00736CC2

Strings

STOP, xrefs: 00736CBC, 00736CC1

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 3534ddd493c9639bf4845917164db8fc284de755b1b78ada218143f0c87bbd91
Instruction ID: 88536fb71b3386e1935d9d56455dea9e4b6f74483a1bd23c55d658a4f7139fb9
Opcode Fuzzy Hash: 3534ddd493c9639bf4845917164db8fc284de755b1b78ada218143f0c87bbd91
Instruction Fuzzy Hash: 85010432B10526AADB21AFBDDC808BF77B5EA61714B004529E85296292EA39E800C760

Function 00731CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00731D4C

Strings

ListBox, xrefs: 00731D16
ComboBox, xrefs: 00731CEB

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e8fb8b9d35726f66f1ac7e18016c512d6491218c14b497c3ed9fbec80f42a5cf
Instruction ID: 8aa6dd330179ae27d6f8c229df31dc4b6ad9d7e2f2ed152511ab1a70497fd943
Opcode Fuzzy Hash: e8fb8b9d35726f66f1ac7e18016c512d6491218c14b497c3ed9fbec80f42a5cf
Instruction Fuzzy Hash: 5701D871B11224ABDB18EBA4DC55CFE7369EB57350F44091AF872573C2EA3859088770

Function 00731BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00731C46

Strings

ListBox, xrefs: 00731C10
ComboBox, xrefs: 00731BE5

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 62033c9b61dabb5e675a745da89209886e9d980bb17c98cd766979a6c4651087
Instruction ID: ce2ed5b33887f172cb3ee2702713faf09f5a97b6cbc0ff6224d0102d0443231d
Opcode Fuzzy Hash: 62033c9b61dabb5e675a745da89209886e9d980bb17c98cd766979a6c4651087
Instruction Fuzzy Hash: 0901F7B1B8010466DF18EBA0D951DFF73A89B11340F50141AB416632C2EA289E0887B5

Function 00731C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00731CC8

Strings

ListBox, xrefs: 00731C94
ComboBox, xrefs: 00731C69

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 685b09d952e9287b6ad801cd81d094061793d47cbf3546521dfaf670e73972f7
Instruction ID: ff7234b53e942ca047fe0b027e1d3d14ec960da2d7611d14587aa980995eb484
Opcode Fuzzy Hash: 685b09d952e9287b6ad801cd81d094061793d47cbf3546521dfaf670e73972f7
Instruction Fuzzy Hash: FA01D6B2B8011867EF15EBA0DA01EFE73A89B11340F54141AB80273282EA689F08D775

Function 006EA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006EA529

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Strings

3yr, xrefs: 006EA545, 006EA54D, 006EA552
,%z, xrefs: 006EA509

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%z$3yr
API String ID: 2551934079-955863410
Opcode ID: 2c4402e50c6b6e5617de2a358b820810c71575378733b799208fc222c24c016d
Instruction ID: a7edfe76951cb832cd2e0e8b42d4ed51f45b5ad6cc231fccb0dd3219fdbcb2c3
Opcode Fuzzy Hash: 2c4402e50c6b6e5617de2a358b820810c71575378733b799208fc222c24c016d
Instruction Fuzzy Hash: 0401F231B017549BD604F7A9E85BAAD3366AB46710F50046DF612572C3EE14AD028AAF

Function 00731D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00731DD3

Strings

ListBox, xrefs: 00731DA0
ComboBox, xrefs: 00731D75

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a88e87eeae5510c05ed2f02422027e061257c22a4b4e3ca336f0dbbbc8d1e937
Instruction ID: 4dae87d5ce3c8b8d04f6f7b60cbadb25790784b6e673f96c5ede2e5b86bd6c87
Opcode Fuzzy Hash: a88e87eeae5510c05ed2f02422027e061257c22a4b4e3ca336f0dbbbc8d1e937
Instruction Fuzzy Hash: 35F0A4B1F5121466EB18E7A4DC56EFE7778AF02750F440D1AB862633C2DA6859088274

Function 00768172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007A3018,007A305C), ref: 007681BF
CloseHandle.KERNEL32 ref: 007681D1

Strings

\0z, xrefs: 0076818A

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0z
API String ID: 3712363035-4117864471
Opcode ID: a61c4887d1ae87d44d9d30118545c56bac6687de06d588077019c85d9200f800
Instruction ID: dcfd1650ff9f9dad5c39c1766fac693be47aafce6192e2c3c65a1f6bcf4a2800
Opcode Fuzzy Hash: a61c4887d1ae87d44d9d30118545c56bac6687de06d588077019c85d9200f800
Instruction Fuzzy Hash: 8FF05EF2640304BAF2206B61AC55FB77A5EEB46750F008425FB09D51A2D67E8A0086BD

Function 0075747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00757493
_wcslen.LIBCMT ref: 007574B9

Strings

3, 3, 16, 1, xrefs: 00757483

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 668f778a576d829853c95fb52ae7cc8b47ad75ac4e95dc629c2aaf48cae7b939
Instruction ID: 385c44522ca8449eb092b8a0874ad614c195783e724050bf3574240c502b062e
Opcode Fuzzy Hash: 668f778a576d829853c95fb52ae7cc8b47ad75ac4e95dc629c2aaf48cae7b939
Instruction Fuzzy Hash: CDE02B423142A01092791279BCC19BF578ACFC6751714182FFE85C2266EED88D91D3E4

Function 00730B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00730B23

Strings

Error allocating memory., xrefs: 00730B1C
AutoIt, xrefs: 00730B17

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: c7474313eb28193b0b9ba0a5ed1d70cffa2dd475f1ff49aa4d315b78f3fcbd51
Instruction ID: db5bb6c375a93d2569122dcf9fc21b6f71fd352c79be6d3f560ff1877fbf2cc8
Opcode Fuzzy Hash: c7474313eb28193b0b9ba0a5ed1d70cffa2dd475f1ff49aa4d315b78f3fcbd51
Instruction Fuzzy Hash: 3FE0DF722853583BE3513795BC03F997A858F05B20F10442EFB88A95C38AEA389046ED

Function 006F0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006EF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,006F0D71,?,?,?,006D100A), ref: 006EF7CE

IsDebuggerPresent.KERNEL32(?,?,?,006D100A), ref: 006F0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,006D100A), ref: 006F0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 006F0D7F

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 08586736283a9378a41a567f06ac25862b2519157e89f1f7dd5278a938f7f14a
Instruction ID: c89ad6e1c1728380409cfe396672cbd7fd08949ee8f91528d2ba984c61e2b0c2
Opcode Fuzzy Hash: 08586736283a9378a41a567f06ac25862b2519157e89f1f7dd5278a938f7f14a
Instruction Fuzzy Hash: 25E06D742003518FE7619FB9E8143667BE5BF04744F00892DE982C6656DBB9E4448B91

Function 006EE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006EE3D5

Strings

8%z, xrefs: 006EE3CA
0%z, xrefs: 006EE3B5

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%z$8%z
API String ID: 1385522511-2349322819
Opcode ID: 4190390cf1a6c48f1de5394a7e45111aae993ceb4ca50ec6c9f91f4c40954f51
Instruction ID: 3744494fa0a67f3dfa4f14a2a431c119b8d081dbc42e476797605829c0a387a6
Opcode Fuzzy Hash: 4190390cf1a6c48f1de5394a7e45111aae993ceb4ca50ec6c9f91f4c40954f51
Instruction Fuzzy Hash: 69E02639C09B54CBCA0CD71DB874A983397BB86320B1042F9E102876D3DB3A28438A5C

Function 00743017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0074302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00743044

Strings

aut, xrefs: 00743038

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 12435f73c79b8c93f44dd01208a040813a5f9e4d8c42e0d4135ebda64f38900d
Instruction ID: c0ca576805dbb845f597cac923ba711d507ade49646d5fa07fe5abf165e31afc
Opcode Fuzzy Hash: 12435f73c79b8c93f44dd01208a040813a5f9e4d8c42e0d4135ebda64f38900d
Instruction Fuzzy Hash: B9D05B715003146BDA209794EC0DFD73A6CD704750F004251BA96D6091DAF89544CAD4

Function 0072D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0072D220

Strings

%.3d, xrefs: 0072D22B
X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 1823d0bf07577613be6fc554173f19c25d3abedaa6638b6d60d2e2043f11883e
Instruction ID: ee66dbbef33b84b311bd7062fc21563a31b46b20e366d64bca3fc53b704cf9fb
Opcode Fuzzy Hash: 1823d0bf07577613be6fc554173f19c25d3abedaa6638b6d60d2e2043f11883e
Instruction Fuzzy Hash: DDD012A1809268EACBA097E0EC498B9B3FCBB08301F608452F90692040D62CC908A761

Function 00762356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076236C
PostMessageW.USER32(00000000), ref: 00762373

Part of subcall function 0073E97B: Sleep.KERNELBASE ref: 0073E9F3

Strings

Shell_TrayWnd, xrefs: 00762365

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: aa9f87cd985d66e141e0a5f42e4a823a704c5eecbd12181930775209819a5beb
Instruction ID: 9eaab2e10343fe383bf4a067f1f56af5326f29a07584b892d261a9c81393eb2f
Opcode Fuzzy Hash: aa9f87cd985d66e141e0a5f42e4a823a704c5eecbd12181930775209819a5beb
Instruction Fuzzy Hash: 6BD0C972381310BAEA65B770EC0FFD67A149B04B10F108A56B687AA1D1C9E8B8018A58

Function 00762322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0076233F

Part of subcall function 0073E97B: Sleep.KERNELBASE ref: 0073E9F3

Strings

Shell_TrayWnd, xrefs: 00762325

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 46cbbf3ae97f3e49109ecde88f6ddd7f6d99ab0f26f23056195d5753ad68c4ec
Instruction ID: ce25b423a7a44cd15642b3326b928e59ee0dfa6404ea332435358f6cfadc79ab
Opcode Fuzzy Hash: 46cbbf3ae97f3e49109ecde88f6ddd7f6d99ab0f26f23056195d5753ad68c4ec
Instruction Fuzzy Hash: EDD01276394310B7EA64B770EC0FFD67A149B04B10F108A56B787AA1D1C9F8B801CB58

Function 0070BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0070BE93
GetLastError.KERNEL32 ref: 0070BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0070BEFC

Memory Dump Source

Source File: 00000000.00000002.2963203918.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2963159480.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963290058.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963363611.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2963400892.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: da159769daa23ccd33682431b2788714aa268a4827e36adbc4999d64d31d6c2d
Instruction ID: 76b2506a48a97cd92147102e5ac7220735100eef9fec7bd39bbc4dcd37e531ce
Opcode Fuzzy Hash: da159769daa23ccd33682431b2788714aa268a4827e36adbc4999d64d31d6c2d
Instruction Fuzzy Hash: B741B335604206EFCF258FA5CC84ABA7BE5AF42710F144269FA59972E1DB349F01CB51

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 23.55.235.170 23.55.235.170
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=-6563510624502596580&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=8684241135348538038&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=3&mngd=0&installdate=1696333686&edu=0&bphint=2&soobedate=1696333682&fg=0 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "fhn6qsQvjeSiYMQxYRE0o4SWV0go1Y2PM5yzaMM3dVw="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveContent-Length: 471Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725873320&P2=404&P3=2&P4=lsqihl2fTDQHt5vqivN5wJm8R1SdcFQX1xerAbZSdUq%2f9%2bJCmCGfNUFEorwuc4Ywy0xoMQJSOTw%2fAWyRE1A2Ow%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: bt3yxtfbhMFk3omQJr4mrESec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\112d6b6c-cbb0-4c6a-8290-09ebf1b179d7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1dc35f69-9cdf-47a2-89b5-3c3d10e86c8e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\488cd63f-0c42-43b3-af31-cc3acd1be6db.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\66fc6aa8-cd02-40fb-9c94-e18ed8d92b5b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7e1d3fca-daa1-4966-812f-85bd3f4d904b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\8496201e-c6c2-4d55-a212-35fdb6939182.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D58214-1D30.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D58215-1E2C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\11e3253d-fbaa-4161-a6b7-38aef6fc5646.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\491ed7ea-5f27-4c7e-a067-672ad73027da.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8a871b30-d44b-428b-aad1-9e7902c1f478.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre